Overview

overview

10

Static

static

0280fb07ef...ed.exe

windows7_x64

10

0280fb07ef...ed.exe

windows10_x64

10

Analysis

  • max time kernel
    10s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-06-2021 03:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0280fb07ef705ee4bcf30994004271ed.exe

  • Size

    3.8MB

  • MD5

    0280fb07ef705ee4bcf30994004271ed

  • SHA1

    b86810d0898b6a85712c3b8c86e24bb1f7b2271b

  • SHA256

    5677b9d1528c45370a17cd4b68fc443862d4304ef1bca005c369c8c1d9158a62

  • SHA512

    338ab8adf9d215ca7a87cd2e12d98c3e8626348f321c05f01ffd1f6688e8e8a75eab64272593187799fad35a2c13b330b1cf2389deffcad17812122d13709945

Score
10/10
elysiumstealerredlinesmokeloadersocelarsvidar10_6_blbackdoorinfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

redline

Botnet

10_6_bl

C2

bynthori.xyz:80

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 11 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 10 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2556
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
        PID:2376
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2336
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
          1⤵
            PID:284
          • C:\Users\Admin\AppData\Local\Temp\0280fb07ef705ee4bcf30994004271ed.exe
            "C:\Users\Admin\AppData\Local\Temp\0280fb07ef705ee4bcf30994004271ed.exe"
            1⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
              "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2676
              • C:\Users\Admin\AppData\Roaming\5225117.exe
                "C:\Users\Admin\AppData\Roaming\5225117.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2988
              • C:\Users\Admin\AppData\Roaming\8487851.exe
                "C:\Users\Admin\AppData\Roaming\8487851.exe"
                3⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:4244
                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:5084
              • C:\Users\Admin\AppData\Roaming\3166307.exe
                "C:\Users\Admin\AppData\Roaming\3166307.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4692
              • C:\Users\Admin\AppData\Roaming\6621026.exe
                "C:\Users\Admin\AppData\Roaming\6621026.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4444
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                  4⤵
                    PID:4332
              • C:\Users\Admin\AppData\Local\Temp\Files.exe
                "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2720
              • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
                2⤵
                • Executes dropped EXE
                PID:4384
              • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                2⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:4432
                • C:\Windows\SysWOW64\rUNdlL32.eXe
                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                  3⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1000
              • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                2⤵
                • Executes dropped EXE
                PID:4572
              • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                2⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  3⤵
                  • Executes dropped EXE
                  PID:4992
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  3⤵
                    PID:4840
                • C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe
                  "C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4472
                • C:\Users\Admin\AppData\Local\Temp\Install.exe
                  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4400
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im chrome.exe
                    3⤵
                      PID:4700
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im chrome.exe
                        4⤵
                        • Kills process with taskkill
                        PID:3124
                • \??\c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s BITS
                  1⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:348
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                    2⤵
                      PID:4792
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                        PID:5680
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                      1⤵
                      • Drops file in Windows directory
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:3968
                    • C:\Windows\system32\browser_broker.exe
                      C:\Windows\system32\browser_broker.exe -Embedding
                      1⤵
                      • Modifies Internet Explorer settings
                      PID:3812
                    • C:\Users\Admin\AppData\Local\Temp\is-N488B.tmp\IDWCH1.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-N488B.tmp\IDWCH1.tmp" /SL5="$1024C,506086,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4664
                      • C:\Users\Admin\AppData\Local\Temp\is-K7A7Q.tmp\รจ8__________________67.exe
                        "C:\Users\Admin\AppData\Local\Temp\is-K7A7Q.tmp\รจ8__________________67.exe" /S /UID=124
                        2⤵
                        • Executes dropped EXE
                        PID:3096
                        • C:\Program Files\Windows Defender Advanced Threat Protection\DISHSTCVNQ\IDownload.exe
                          "C:\Program Files\Windows Defender Advanced Threat Protection\DISHSTCVNQ\IDownload.exe" /VERYSILENT
                          3⤵
                            PID:6136
                            • C:\Users\Admin\AppData\Local\Temp\is-90UF0.tmp\IDownload.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-90UF0.tmp\IDownload.tmp" /SL5="$202D4,994212,425984,C:\Program Files\Windows Defender Advanced Threat Protection\DISHSTCVNQ\IDownload.exe" /VERYSILENT
                              4⤵
                                PID:5180
                                • C:\Program Files (x86)\IDownload\IDownload.App.exe
                                  "C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu
                                  5⤵
                                    PID:5400
                                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\goqktuau.cmdline"
                                      6⤵
                                        PID:5780
                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6170.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC616F.tmp"
                                          7⤵
                                            PID:5068
                                  • C:\Users\Admin\AppData\Local\Temp\b7-c7b4b-efd-e6f9f-b87646a4c5d64\Gisaedinogy.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b7-c7b4b-efd-e6f9f-b87646a4c5d64\Gisaedinogy.exe"
                                    3⤵
                                      PID:5536
                                    • C:\Users\Admin\AppData\Local\Temp\e5-195a6-57b-3f4a7-2888f8fdd6382\Julabukycu.exe
                                      "C:\Users\Admin\AppData\Local\Temp\e5-195a6-57b-3f4a7-2888f8fdd6382\Julabukycu.exe"
                                      3⤵
                                        PID:5616
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nwk1u0nz.wns\001.exe & exit
                                          4⤵
                                            PID:5596
                                            • C:\Users\Admin\AppData\Local\Temp\nwk1u0nz.wns\001.exe
                                              C:\Users\Admin\AppData\Local\Temp\nwk1u0nz.wns\001.exe
                                              5⤵
                                                PID:5964
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gtt55ixa.wa5\GcleanerEU.exe /eufive & exit
                                              4⤵
                                                PID:488
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wh3no3yw.0k5\installer.exe /qn CAMPAIGN="654" & exit
                                                4⤵
                                                  PID:5456
                                                  • C:\Users\Admin\AppData\Local\Temp\wh3no3yw.0k5\installer.exe
                                                    C:\Users\Admin\AppData\Local\Temp\wh3no3yw.0k5\installer.exe /qn CAMPAIGN="654"
                                                    5⤵
                                                      PID:6008
                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\wh3no3yw.0k5\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\wh3no3yw.0k5\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1623121603 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                        6⤵
                                                          PID:4188
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\okpq3qhx.lfv\gaoou.exe & exit
                                                      4⤵
                                                        PID:4456
                                                        • C:\Users\Admin\AppData\Local\Temp\okpq3qhx.lfv\gaoou.exe
                                                          C:\Users\Admin\AppData\Local\Temp\okpq3qhx.lfv\gaoou.exe
                                                          5⤵
                                                            PID:5260
                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                              6⤵
                                                              • Modifies registry class
                                                              PID:4792
                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                              6⤵
                                                                PID:5500
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qh1wa5xq.zky\Setup3310.exe /Verysilent /subid=623 & exit
                                                            4⤵
                                                              PID:4580
                                                              • C:\Users\Admin\AppData\Local\Temp\qh1wa5xq.zky\Setup3310.exe
                                                                C:\Users\Admin\AppData\Local\Temp\qh1wa5xq.zky\Setup3310.exe /Verysilent /subid=623
                                                                5⤵
                                                                  PID:5312
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-V4OEM.tmp\Setup3310.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-V4OEM.tmp\Setup3310.tmp" /SL5="$1039A,138429,56832,C:\Users\Admin\AppData\Local\Temp\qh1wa5xq.zky\Setup3310.exe" /Verysilent /subid=623
                                                                    6⤵
                                                                      PID:6088
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-BNCHR.tmp\Setup.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-BNCHR.tmp\Setup.exe" /Verysilent
                                                                        7⤵
                                                                          PID:2644
                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                            8⤵
                                                                              PID:4424
                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                9⤵
                                                                                  PID:5600
                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                  9⤵
                                                                                    PID:6964
                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                  8⤵
                                                                                    PID:4152
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                      9⤵
                                                                                        PID:4804
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /im RunWW.exe /f
                                                                                          10⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:6008
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout /t 6
                                                                                          10⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:7280
                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                      8⤵
                                                                                        PID:4120
                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-C05QQ.tmp\lylal220.tmp
                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-C05QQ.tmp\lylal220.tmp" /SL5="$4041E,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                          9⤵
                                                                                            PID:4016
                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-2PTOL.tmp\56FT____________________.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-2PTOL.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                              10⤵
                                                                                                PID:6300
                                                                                                • C:\Program Files\Mozilla Firefox\IOXBKGLABP\irecord.exe
                                                                                                  "C:\Program Files\Mozilla Firefox\IOXBKGLABP\irecord.exe" /VERYSILENT
                                                                                                  11⤵
                                                                                                    PID:6956
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-PJ5QC.tmp\irecord.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-PJ5QC.tmp\irecord.tmp" /SL5="$302C4,6139911,56832,C:\Program Files\Mozilla Firefox\IOXBKGLABP\irecord.exe" /VERYSILENT
                                                                                                      12⤵
                                                                                                        PID:6516
                                                                                                        • C:\Program Files (x86)\recording\i-record.exe
                                                                                                          "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                          13⤵
                                                                                                            PID:4472
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d-2232a-8cc-13bb4-d65921b4e1527\Mewilylyzhi.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d-2232a-8cc-13bb4-d65921b4e1527\Mewilylyzhi.exe"
                                                                                                        11⤵
                                                                                                          PID:6424
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\23-fd05f-c17-b41a1-15bd36860859b\Towaewaenuna.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\23-fd05f-c17-b41a1-15bd36860859b\Towaewaenuna.exe"
                                                                                                          11⤵
                                                                                                            PID:7120
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ymfi5acd.aog\001.exe & exit
                                                                                                              12⤵
                                                                                                                PID:6052
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ymfi5acd.aog\001.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ymfi5acd.aog\001.exe
                                                                                                                  13⤵
                                                                                                                    PID:3680
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kht5rxlu.gji\GcleanerEU.exe /eufive & exit
                                                                                                                  12⤵
                                                                                                                    PID:5428
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j23ajjd3.hlq\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                    12⤵
                                                                                                                      PID:6052
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\j23ajjd3.hlq\installer.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\j23ajjd3.hlq\installer.exe /qn CAMPAIGN="654"
                                                                                                                        13⤵
                                                                                                                          PID:1436
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a4a3xt2z.0r3\gaoou.exe & exit
                                                                                                                        12⤵
                                                                                                                          PID:7172
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a4a3xt2z.0r3\gaoou.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\a4a3xt2z.0r3\gaoou.exe
                                                                                                                            13⤵
                                                                                                                              PID:7304
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                14⤵
                                                                                                                                  PID:7756
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                  14⤵
                                                                                                                                    PID:7636
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mh2ldbrc.5zg\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                12⤵
                                                                                                                                  PID:7448
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mh2ldbrc.5zg\Setup3310.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\mh2ldbrc.5zg\Setup3310.exe /Verysilent /subid=623
                                                                                                                                    13⤵
                                                                                                                                      PID:4548
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-RMB7C.tmp\Setup3310.tmp
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-RMB7C.tmp\Setup3310.tmp" /SL5="$40558,138429,56832,C:\Users\Admin\AppData\Local\Temp\mh2ldbrc.5zg\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                        14⤵
                                                                                                                                          PID:7496
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-2MS97.tmp\Setup.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-2MS97.tmp\Setup.exe" /Verysilent
                                                                                                                                            15⤵
                                                                                                                                              PID:8784
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uvlqmcla.hos\google-game.exe & exit
                                                                                                                                        12⤵
                                                                                                                                          PID:7980
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\uvlqmcla.hos\google-game.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\uvlqmcla.hos\google-game.exe
                                                                                                                                            13⤵
                                                                                                                                              PID:6356
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t1vzedlz.o10\005.exe & exit
                                                                                                                                            12⤵
                                                                                                                                              PID:1816
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\t1vzedlz.o10\005.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\t1vzedlz.o10\005.exe
                                                                                                                                                13⤵
                                                                                                                                                  PID:5548
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hvdewf2d.adi\GcleanerWW.exe /mixone & exit
                                                                                                                                                12⤵
                                                                                                                                                  PID:6360
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\exedvhc3.iuy\702564a0.exe & exit
                                                                                                                                                  12⤵
                                                                                                                                                    PID:8748
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\exedvhc3.iuy\702564a0.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\exedvhc3.iuy\702564a0.exe
                                                                                                                                                      13⤵
                                                                                                                                                        PID:7464
                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                              8⤵
                                                                                                                                                PID:5796
                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                  9⤵
                                                                                                                                                    PID:5060
                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                  8⤵
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:4664
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-4DQ8V.tmp\LabPicV3.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-4DQ8V.tmp\LabPicV3.tmp" /SL5="$30442,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                    9⤵
                                                                                                                                                      PID:3744
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-JU3T0.tmp\_____________.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-JU3T0.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                        10⤵
                                                                                                                                                          PID:6332
                                                                                                                                                          • C:\Program Files\Windows Mail\FELSJQPAPY\prolab.exe
                                                                                                                                                            "C:\Program Files\Windows Mail\FELSJQPAPY\prolab.exe" /VERYSILENT
                                                                                                                                                            11⤵
                                                                                                                                                              PID:6500
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-3294V.tmp\prolab.tmp
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-3294V.tmp\prolab.tmp" /SL5="$7006A,575243,216576,C:\Program Files\Windows Mail\FELSJQPAPY\prolab.exe" /VERYSILENT
                                                                                                                                                                12⤵
                                                                                                                                                                  PID:7044
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dc-6da4b-67f-9a882-4a6878fc1f61f\Bunebiquhu.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dc-6da4b-67f-9a882-4a6878fc1f61f\Bunebiquhu.exe"
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:4832
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f0-77a97-6af-f81b3-ad4818c3951bf\Hatynezhaefy.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f0-77a97-6af-f81b3-ad4818c3951bf\Hatynezhaefy.exe"
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:6752
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5vr2rcil.rdf\001.exe & exit
                                                                                                                                                                      12⤵
                                                                                                                                                                        PID:4960
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5vr2rcil.rdf\001.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\5vr2rcil.rdf\001.exe
                                                                                                                                                                          13⤵
                                                                                                                                                                            PID:3024
                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3oxt3ska.ibi\GcleanerEU.exe /eufive & exit
                                                                                                                                                                          12⤵
                                                                                                                                                                            PID:3024
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j0ap1xon.vy1\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:772
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\j0ap1xon.vy1\installer.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\j0ap1xon.vy1\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                13⤵
                                                                                                                                                                                  PID:5688
                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\j0ap1xon.vy1\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\j0ap1xon.vy1\ EXE_CMD_LINE="/forcecleanup /wintime 1623121603 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                    14⤵
                                                                                                                                                                                      PID:6744
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rha1u0qg.2hc\gaoou.exe & exit
                                                                                                                                                                                  12⤵
                                                                                                                                                                                    PID:7380
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\rha1u0qg.2hc\gaoou.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\rha1u0qg.2hc\gaoou.exe
                                                                                                                                                                                      13⤵
                                                                                                                                                                                        PID:7552
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                          14⤵
                                                                                                                                                                                            PID:7908
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                            14⤵
                                                                                                                                                                                              PID:6804
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wiomy02j.uwi\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                          12⤵
                                                                                                                                                                                            PID:7568
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\wiomy02j.uwi\Setup3310.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\wiomy02j.uwi\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                              13⤵
                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-4P9B4.tmp\Setup3310.tmp
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-4P9B4.tmp\Setup3310.tmp" /SL5="$605A8,138429,56832,C:\Users\Admin\AppData\Local\Temp\wiomy02j.uwi\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                    PID:7336
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-OCEG5.tmp\Setup.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-OCEG5.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                        PID:3884
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5y4bgpuw.pwx\google-game.exe & exit
                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                    PID:7588
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5y4bgpuw.pwx\google-game.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\5y4bgpuw.pwx\google-game.exe
                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                        PID:6560
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kmdy15tf.zda\005.exe & exit
                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                        PID:6520
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\kmdy15tf.zda\005.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\kmdy15tf.zda\005.exe
                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                            PID:8020
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o53vc3zb.def\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                            PID:7984
                                                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\Cube_WW.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\Cube_WW.exe"
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:4060
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup_2.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup_2.exe
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:6404
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup_2.exe"
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:7144
                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                PID:6360
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\VCBuilds\app.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\VCBuilds\app.exe
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:6392
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\VCBuilds\Setup2.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\VCBuilds\Setup2.exe
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:6440
                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:5240
                                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 596
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:6484
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\VCBuilds\2_5337105938887217200.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\VCBuilds\2_5337105938887217200.exe
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:6492
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 732
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:6684
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\VCBuilds\jooyu.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\VCBuilds\jooyu.exe
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                  PID:6464
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                      PID:7000
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                        PID:6752
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\VCBuilds\UnpackChrome.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\VCBuilds\UnpackChrome.exe
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:6536
                                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                            PID:6324
                                                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3888.0.1974980459\1930480803" -parentBuildID 20200403170909 -prefsHandle 1388 -prefMapHandle 1380 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3888 "\\.\pipe\gecko-crash-server-pipe.3888" 1468 gpu
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:7624
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffbab9c4f50,0x7ffbab9c4f60,0x7ffbab9c4f70
                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1872 /prefetch:8
                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                        PID:4440
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1860 /prefetch:8
                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                          PID:7776
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:2
                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                            PID:7284
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                PID:6504
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                  PID:6508
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                    PID:8272
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                      PID:8332
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                        PID:8388
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                          PID:9200
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7c1f8a890,0x7ff7c1f8a8a0,0x7ff7c1f8a8b0
                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                PID:8524
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 /prefetch:8
                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                PID:8688
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,15824894109227926698,5156770565722860348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:8
                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                  PID:8856
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "cmd.exe" /C taskkill /F /PID 6536 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\VCBuilds\UnpackChrome.exe"
                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                  PID:2116
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                    taskkill /F /PID 6536
                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                    PID:8040
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "cmd.exe" /C taskkill /F /PID 6536 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\VCBuilds\UnpackChrome.exe"
                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                      taskkill /F /PID 6536
                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\VCBuilds\ner.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\VCBuilds\ner.exe
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                    PID:6604
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "ner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\VCBuilds\ner.exe" & exit
                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                          taskkill /im "ner.exe" /f
                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\VCBuilds\app.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\VCBuilds\app.exe
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                        PID:6584
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\VCBuilds\VinDiesel.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\VCBuilds\VinDiesel.exe
                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                          PID:6664
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\VCBuilds\Vlcplayer.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\VCBuilds\Vlcplayer.exe
                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Starne.vssm
                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                PID:6220
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd
                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                    PID:5864
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                      findstr /V /R "^xOPnRHccwLlqXLcXNbyVTewvYBNUOQNrBSTCQBDisCMXHQdfMnqcbQQsNaAfTAGlYuntRSikUYDddrOilnofQsGKeCObwhhQVBYBaknTsPBmhmwJEzycasxGmNeftJpG$" Cercando.vssm
                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com
                                                                                                                                                                                                                                                                                                        Distinte.exe.com q
                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Distinte.exe.com q
                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                              PID:6320
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                            ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\VCBuilds\Lovebirds_2021-06-10_19-23.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\VCBuilds\Lovebirds_2021-06-10_19-23.exe
                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                        PID:6716
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\VCBuilds\10_6_r_net.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\VCBuilds\10_6_r_net.exe
                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                          PID:6724
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                            C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                              PID:7092
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\VCBuilds\google-game.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\VCBuilds\google-game.exe
                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                              PID:6780
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\setup_2.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\setup_2.exe
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                  PID:7720
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\setup_2.exe"
                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                        ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                        PID:8020
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\Setup2.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\Setup2.exe
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:7768
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\app.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\app.exe
                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                        PID:7832
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\Lovebirds_2021-06-10_19-23.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\Lovebirds_2021-06-10_19-23.exe
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\UnpackChrome.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\UnpackChrome.exe
                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                            PID:7912
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              "cmd.exe" /C taskkill /F /PID 7912 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnpackChrome.exe"
                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                  taskkill /F /PID 7912
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                  PID:7396
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                "cmd.exe" /C taskkill /F /PID 7912 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnpackChrome.exe"
                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                    taskkill /F /PID 7912
                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                    PID:7236
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\google-game.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\google-game.exe
                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                  PID:8080
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\10_6_r_net.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\10_6_r_net.exe
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                    PID:7996
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                      C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                        PID:8072
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                        C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                          PID:7876
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\Vlcplayer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\Vlcplayer.exe
                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                          PID:7952
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Starne.vssm
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                              PID:6792
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd
                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4228
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                                    findstr /V /R "^xOPnRHccwLlqXLcXNbyVTewvYBNUOQNrBSTCQBDisCMXHQdfMnqcbQQsNaAfTAGlYuntRSikUYDddrOilnofQsGKeCObwhhQVBYBaknTsPBmhmwJEzycasxGmNeftJpG$" Cercando.vssm
                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                      PID:9040
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Distinte.exe.com
                                                                                                                                                                                                                                                                                                                                                      Distinte.exe.com q
                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                        PID:8608
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                        ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                        PID:8868
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\2_5337105938887217200.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\2_5337105938887217200.exe
                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7820
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 692
                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                      PID:7940
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\jooyu.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\jooyu.exe
                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7608
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8860
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\VinDiesel.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\VinDiesel.exe
                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3876
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\ner.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\ner.exe
                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                              PID:8184
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "ner.exe" /f & erase "C:\Users\Admin\Documents\ner.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:8908
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                    taskkill /im "ner.exe" /f
                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                    PID:9056
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\app.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\app.exe"
                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:7296
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ll1l4ydz.p4s\google-game.exe & exit
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4944
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ll1l4ydz.p4s\google-game.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\ll1l4ydz.p4s\google-game.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2264
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aqw2du4f.oy5\005.exe & exit
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5132
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aqw2du4f.oy5\005.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\aqw2du4f.oy5\005.exe
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j431t3ip.0fw\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jdospzks.xda\702564a0.exe & exit
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7852
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jdospzks.xda\702564a0.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jdospzks.xda\702564a0.exe
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:8004
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5944
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6128
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding E7EFFAEE963AC91A753238CA5EA61D58 C
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 8E0FBB38559B57CD542ED30318360A0C
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 2D7D46426CF7D1AEE0949BEBF6D63912 E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 8AEBC24042A0376A0D6D5BBCB381D20D C
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7812
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 55DB2469D7DCD91CC4227EB7F6163B7E
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:8452
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                            PID:7996
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x41c
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6476
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7708
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                werfault.exe /h /shared Global\c937e3146e414855bc866e91dd510ad2 /t 8148 /p 7708
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:504
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9016
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:8776
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:8896
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\sjufbbw
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\sjufbbw
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5880

                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/284-239-0x000001E9D2720000-0x000001E9D2790000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/348-225-0x000001ACA41A0000-0x000001ACA4210000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/348-219-0x000001ACA40E0000-0x000001ACA412B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          300KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/936-266-0x000001FCFCFD0000-0x000001FCFD040000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1000-226-0x0000000001250000-0x00000000012AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          368KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1000-223-0x00000000047FE000-0x00000000048FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1100-264-0x0000022791B30000-0x0000022791BA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1216-260-0x00000219A3B00000-0x00000219A3B70000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1256-255-0x000001CB5A8D0000-0x000001CB5A940000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1408-268-0x000002490C840000-0x000002490C8B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1944-270-0x0000021E26FD0000-0x0000021E27040000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2336-253-0x0000022D32210000-0x0000022D32280000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2376-262-0x0000028914880000-0x00000289148F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2556-234-0x000001833F0D0000-0x000001833F140000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2636-258-0x000002BC90080000-0x000002BC900F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2660-271-0x000001D1896C0000-0x000001D189730000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2676-125-0x0000000002A00000-0x0000000002A02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2676-124-0x0000000001020000-0x000000000103B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          108KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2676-120-0x0000000000900000-0x0000000000901000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2988-195-0x0000000007E00000-0x0000000007E01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2988-158-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2988-166-0x0000000002410000-0x000000000243C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          176KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2988-172-0x0000000002460000-0x0000000002461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2988-135-0x00000000023F0000-0x00000000023F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2988-129-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3008-308-0x00000000026E0000-0x00000000026F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3096-221-0x0000000002A00000-0x0000000002A02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4244-167-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4244-155-0x0000000009350000-0x0000000009351000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4244-169-0x0000000002290000-0x0000000002291000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4244-134-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4244-138-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4244-149-0x0000000002200000-0x000000000220E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-201-0x00000000059B0000-0x00000000059B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-194-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          120KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-203-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-215-0x0000000005600000-0x0000000005601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-205-0x0000000005350000-0x0000000005351000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-207-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4332-216-0x0000000005390000-0x0000000005391000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-147-0x0000000000400000-0x00000000005DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4444-180-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4444-153-0x00000000007E0000-0x00000000007E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4472-156-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          436KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4572-275-0x0000000000450000-0x00000000004FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          696KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4572-276-0x0000000000400000-0x000000000044D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          308KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4664-181-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4692-176-0x00000000002E0000-0x00000000002E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4692-179-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4692-182-0x0000000004AD0000-0x0000000004B09000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          228KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4692-184-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4692-183-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4792-238-0x000002755F300000-0x000002755F370000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          448KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5084-217-0x0000000002D40000-0x0000000002D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5084-206-0x000000000A7F0000-0x000000000A7F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5180-298-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5312-345-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5400-326-0x00000000010A5000-0x00000000010A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5400-329-0x00000000010A6000-0x00000000010A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5400-325-0x00000000010A4000-0x00000000010A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5400-323-0x00000000010A2000-0x00000000010A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5400-299-0x00000000010A0000-0x00000000010A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5536-300-0x0000000002500000-0x0000000002502000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5616-307-0x0000000002870000-0x0000000002872000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5616-320-0x0000000002872000-0x0000000002874000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5616-324-0x0000000002875000-0x0000000002876000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5680-350-0x0000023C154A0000-0x0000023C154BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          104KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5680-310-0x0000023C153C0000-0x0000023C15431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          452KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5680-309-0x0000023C15230000-0x0000023C1527B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          300KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5680-346-0x0000023C17B00000-0x0000023C17C06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5780-322-0x00000000021C0000-0x00000000021C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5964-331-0x0000000000580000-0x00000000006CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5964-330-0x00000000001F0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6088-349-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6088-347-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6088-348-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6136-284-0x0000000000400000-0x000000000046E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                          440KB

                                                                                                                                                                                                                                                                                                                                                                                                          Download