Overview

overview

8

Static

static

1

C/ProgramD...ff.exe

windows7-x64

8

C/ProgramD...ff.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    13-02-2023 20:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    C/ProgramData/Sentinel/AFUCache/d0665e370b2871a328ec8bcf86ade816e696d411430ff6586cf8e3dad1be20ff.exe

  • Size

    9.3MB

  • MD5

    59501f98b000a7bb713950310fabf73b

  • SHA1

    0872ab73aa1edde06224a59b9e5f8e8db6418833

  • SHA256

    d0665e370b2871a328ec8bcf86ade816e696d411430ff6586cf8e3dad1be20ff

  • SHA512

    0ba73c470e3e6a859ca92444c9e4ff1dedfb39347385f8e28ca6a94fca304daa4dd1c49049af7748fea07e6fca755ac6fb75bfb408588e26e97c897a34f98b02

  • SSDEEP

    196608:3yWDJp+GJ4FRT3qboM/PzujcKGJDKulb/hz8JQ8QnFDRfHVB7c:3yI2GJ4S/CjcXeyfnfVB7c

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Registers new Print Monitor 2 TTPs 10 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 60 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\C\ProgramData\Sentinel\AFUCache\d0665e370b2871a328ec8bcf86ade816e696d411430ff6586cf8e3dad1be20ff.exe
    "C:\Users\Admin\AppData\Local\Temp\C\ProgramData\Sentinel\AFUCache\d0665e370b2871a328ec8bcf86ade816e696d411430ff6586cf8e3dad1be20ff.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\extrac32.exe
        C:\Windows\system32\extrac32.exe /L "C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82X\" /E "C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82X\TPDBase.cab"
        3⤵
          PID:668
        • C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\Setup.exe
          "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\Setup.exe" -s2
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2376
          • C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB710\Setup.exe
            "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB710\Setup.exe" -s2
            4⤵
            • Drops file in Drivers directory
            • Sets service image path in registry
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2472
            • C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB710\TMUSB64\dpinst.exe
              TMUSB64\dpinst.exe /s /se /sw /sa /el
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:2772
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 printui.dll,PrintUIEntry /ia /f "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T\EA6INSTMT.INF" /m "EPSON TM-T(203dpi) Receipt6"
          3⤵
          • Drops file in Windows directory
          PID:1020
        • C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSB64\DPInst.exe
          "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\TMUSB\TMUSB800\TMUSB64\DPInst.exe" /PATH "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\Driver\TM-T" /se /sw /sa /el
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1332
        • C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\PrinterReg.exe
          "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\PrinterReg.exe" /install /dev=TM-T82X
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1440
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:856
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      1⤵
      • Executes dropped EXE
      PID:1492
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1548
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2092
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 250 -NGENProcess 258 -Pipe 25c -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2372
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 1f0 -Pipe 240 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2536
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 248 -NGENProcess 1f0 -Pipe 240 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2716
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 24c -NGENProcess 258 -Pipe 1d8 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1652
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 260 -NGENProcess 254 -Pipe 244 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2472
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 1f0 -Pipe 1e8 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2260
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 248 -NGENProcess 258 -Pipe 26c -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2852
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 268 -Pipe 1e0 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:748
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 270 -NGENProcess 1f0 -Pipe 1d4 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2892
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 258 -Pipe 24c -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1392
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 258 -NGENProcess 248 -Pipe 27c -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1100
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 268 -NGENProcess 278 -Pipe 280 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2196
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 264 -NGENProcess 260 -Pipe 254 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2268
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 264 -NGENProcess 268 -Pipe 248 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1828
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1f0 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2852
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 28c -NGENProcess 284 -Pipe 274 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1712
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 270 -NGENProcess 260 -Pipe 288 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1760
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 260 -NGENProcess 258 -Pipe 298 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2460
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 278 -NGENProcess 294 -Pipe 290 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1696
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 270 -NGENProcess 2a0 -Pipe 260 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1392
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 294 -Pipe 264 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2068
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2a4 -NGENProcess 29c -Pipe 268 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2196
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 294 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:1944
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1140
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2716
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2376
    • C:\Windows\system32\dllhost.exe
      C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1752
    • C:\Windows\ehome\ehRecvr.exe
      C:\Windows\ehome\ehRecvr.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1736
    • C:\Windows\ehome\ehsched.exe
      C:\Windows\ehome\ehsched.exe
      1⤵
      • Executes dropped EXE
      PID:1544
    • C:\Windows\eHome\EhTray.exe
      "C:\Windows\eHome\EhTray.exe" /nav:-2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1648
    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1532
    • C:\Windows\ehome\ehRec.exe
      C:\Windows\ehome\ehRec.exe -Embedding
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1756
    • C:\Windows\system32\IEEtwCollector.exe
      C:\Windows\system32\IEEtwCollector.exe /V
      1⤵
      • Executes dropped EXE
      PID:1612
    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
      1⤵
      • Executes dropped EXE
      PID:1872
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2288
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2440
    • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2616
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Executes dropped EXE
      PID:2732
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2872
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2932
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:3028
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2128
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2232
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:2308
    • C:\Program Files\Windows Media Player\wmpnetwk.exe
      "C:\Program Files\Windows Media Player\wmpnetwk.exe"
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3406023954-474543476-3319432036-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3406023954-474543476-3319432036-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2164
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
        2⤵
          PID:1656
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2380
      • C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\APDLog.exe
        "C:\Program Files (x86)\EPSON\EPSON Advanced Printer Driver 6\DriverPack\PrinterReg\APDLog.exe"
        1⤵
        • Executes dropped EXE
        PID:2760
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
        1⤵
          PID:2852
        • C:\Windows\System32\spoolsv.exe
          C:\Windows\System32\spoolsv.exe
          1⤵
          • Registers new Print Monitor
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:428
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{3c364cd3-ef10-40ba-6314-0a0f3cb24b7e}\tmusb64.inf" "9" "6d91b5e93" "00000000000005A8" "WinSta0\Default" "00000000000003D8" "208" "c:\program files (x86)\epson\epson advanced printer driver 6\driverpack\tmusb\tmusb710\tmusb64"
          1⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2896
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{51a6a706-9f80-73e9-c1a2-9a09bdf7cf35}\ea6instmt.inf" "9" "690c6e86f" "00000000000003D8" "WinSta0\Default" "00000000000005AC" "208" "c:\program files (x86)\epson\epson advanced printer driver 6\driverpack\driver\tm-t"
          1⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{334a3f4c-38fd-5c99-e44d-a74859666406} Global\{0cf0cd81-ac91-3a88-e72e-036506e07b52} C:\Windows\System32\DriverStore\Temp\{7255c8bb-faf5-0d93-5761-07588fa58e72}\ea6instmt.inf C:\Windows\System32\DriverStore\Temp\{7255c8bb-faf5-0d93-5761-07588fa58e72}\EA6INSTMT.cat
            2⤵
              PID:2068
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005C8" "00000000000005C4"
            1⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:2252

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
            Filesize

            1.6MB

            MD5

            57e3098a6b798f3c9f54b599de4cac54

            SHA1

            811f2973fbcf8006aa52b413298c6775d909c535

            SHA256

            548821f53bc8ce32cf3ed6ebaa33b8c172d5996df6828be8e9e87e75b4fe7b7c

            SHA512

            db607a58e6a25b1ed3c6e6ce6baf5a92ceff82a6c8c13c68e8d6536cbdf13fec2bfdf856196540be6aa90f4fdd9a672341640691c21718e868620af9de10a94a

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
            Filesize

            30.1MB

            MD5

            c5d1b0c75a04478892ff80f41db21c23

            SHA1

            7597d4a1bf367a37dc84edeab2c68783db9503a3

            SHA256

            7ef4501aa7e6ea59d5813538f7e969f8be04eedd74f7938065e1d355a5f09105

            SHA512

            93ccf1a50376ea412e3de5b7a386305bd534bc27d3be72bc847d5e36e23e45e814d58a76c9fb7e0d97c1c2e8caa9f6da959a012f66ef429c68b0f50086c8d9ef

            Download Submit

          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            Filesize

            1.7MB

            MD5

            82873cab256774694a7cba4bf753e080

            SHA1

            482fa36b60539c393b4c6f8711272b3f21e3a3e6

            SHA256

            3fab57ee13f94ef79add245de46ffae1a99ab05296e5921728651c5f314a16cf

            SHA512

            7ee9733f19453e5899d61c14ada3f7accf1f61752e134a9d2d8d79b00da90796a4d007b3aa8e6f683da753d07c380d96fbfda69ef427c70f63c056a6507143db

            Download Submit

          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
            Filesize

            5.2MB

            MD5

            899e03ba5bf6588cc423cf784d4241eb

            SHA1

            e70a03f165608f5c1143b771a620fa5c7e9311b3

            SHA256

            a1ac5b69be13e162273d2075839002da6659bb4466640d676bf4df0cf7db72de

            SHA512

            21b0f15dd9366362cbec277fc28aa7e435b63f56482350f5b0aa335b1d38d9346fb61eb79492c9d255e93365725117308838be739d223dce905dfce5fd729735

            Download Submit

          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
            Filesize

            2.0MB

            MD5

            51b3ad264a23b6f4d52a6d3c643baa2c

            SHA1

            c766542d7d268eb2552994c247ec59017db70358

            SHA256

            09529a18fc9bc88ffdc50d31e2949fa44306571b530a9dc102d0b1a12f337099

            SHA512

            dc39735a798b39765937bd2509e4d457640c2b600dbbfafe6207f80f3da8835fc3f4aef1bf1ef44e2027f35b2230e5330c75e22b9bb50692315efb8b79aa438e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\EA6INSTMT.INF
            Filesize

            21KB

            MD5

            2ae19a6615bc5139b3b13e4b2f24865d

            SHA1

            a4840e483e8168a17f1ae939ef7be01576e705f7

            SHA256

            96ac2f5a22f6ba2b24339941d4377355b5d7095e72fd7443e9c37599f3d9fb88

            SHA512

            9ebcf21517dc0ac9b14b05484874fba0de71e0cd8b65290148bb5e42734861ca60e5ba26c98d9692390ce25bb59259aaa6c848a2e8bc945a4696c6e820ce202d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6Bcd0.dll
            Filesize

            270KB

            MD5

            4269b08f7a99bff6dbb6a547d04ca495

            SHA1

            6633c932fe5883e2f87d5afdaa9664324bfb93c3

            SHA256

            475b7dfe59285e22a5cc9929fa18bb05357b25d6e95012e732cf32f9bc8af79e

            SHA512

            09bc943f7c32202a44ed7fe54b6f4ff25bdca112710277d260d5495c324aedbcafabeb8c8a2dff414f451e95a1466a65c3dc236049bd0bc665cca6dfca15357a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6BcdR0.dll
            Filesize

            18KB

            MD5

            588fc77dfbf5adabd56b90c653ac39a0

            SHA1

            27f0143fb57bc407ff438a808da1ced71161649c

            SHA256

            e5aaea8c5c61752078145aeb474d6a9bbb0d0975c78e181e911d7dc8242a3f18

            SHA512

            7fdf27e11919afaf2b26fb17813ed43f060e9f1f8b431a1922f65665defdaf842fe9561e8848c9f09cdca595afad504e8b0a69f1367303ea6e77cc352bf7c453

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6LMTM.DLL
            Filesize

            305KB

            MD5

            22df1ba2a6a41a0bbf70515f45157f4b

            SHA1

            4ddcebda297dcd9748a74e2f0520132a7d5b6706

            SHA256

            3dde7201c6eb91ad297ad750a3fae7a4f756fd4ee7751e396fb8afab818d7acb

            SHA512

            21f7d31a9a1c828cc1ea4a629c815331b48c8a52c9ee14c89f9befd49e6230e1d6942eaf11f2d277693d49fd8df9197eacf063cfe172af0983329953c16e5c81

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6RDPTM.DLL
            Filesize

            1.4MB

            MD5

            329e3321ab586ce3b8595bc7ad8acf7d

            SHA1

            51f6323e8f80e7bf9b458c6c327d0cd9144495c4

            SHA256

            13d1855b0e5e337af94e052ad1857de7f8217f7dc9bf40acf64d48cb808bd6bd

            SHA512

            a695fd540eb67a4a1b82c9c92391545a9149daa2484477e9345c5d80c04a8ca9452e798883fc764f1394ebec22b8e74c7a9faa6a3e74ed87b18c635f7a543bab

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\amd64\EA6UIPTM.DLL
            Filesize

            1.2MB

            MD5

            71e56b73e4f690beea2eec1cce0434cf

            SHA1

            1796b7ae75d00d6e7b29ed12c8e35c530db1b39f

            SHA256

            15636cfbe5ed07a3b7f0d75253152d44b073dab88aea17704d9334ff41211edf

            SHA512

            8c2de1470f3a00377dca242111cd7c31828ff1ca7330af4936e6126be0a9b5c5d5a9010389724d699a5d4d70b23f8670451eb3bc2b3fe9604e93ea6254452772

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Driver\TM-T\ea6instmt.cat
            Filesize

            27KB

            MD5

            bbc14751fd719557c776fc87c0deb000

            SHA1

            111fbe6b40e1dd62373bbe705a8c4e6558c4f6b4

            SHA256

            e0dacb3a803fb8dffa84ab383420ba1595d2435bd3461b27ade82680719277a0

            SHA512

            073b66fb699e6b03484bbd0476c3e8dffb81b0ddf3deca014ac2609a0d87ff91b15c26997c549931444f1fb7ca26bc18b7dd7e5fb99f1953bd13b5cc8dcc30fe

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe
            Filesize

            829KB

            MD5

            fba8adddc1391ef3b27c160e62a38b7a

            SHA1

            2b361c917b3356e4831f31994b853b24a35d7f56

            SHA256

            36c8a7a911da1148ffa3257ad6e9f82c59d5325325ab2545d9cc754d7bb43f31

            SHA512

            99df725b645ffb63dfda063fb12d0a7c9109ef32d37e9c28eed24c6267d494daed47c9e8d0ef5e0f874c5e154f0f385b44ff7442018b018e3b6e13e2b1fa8fc3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe
            Filesize

            829KB

            MD5

            fba8adddc1391ef3b27c160e62a38b7a

            SHA1

            2b361c917b3356e4831f31994b853b24a35d7f56

            SHA256

            36c8a7a911da1148ffa3257ad6e9f82c59d5325325ab2545d9cc754d7bb43f31

            SHA512

            99df725b645ffb63dfda063fb12d0a7c9109ef32d37e9c28eed24c6267d494daed47c9e8d0ef5e0f874c5e154f0f385b44ff7442018b018e3b6e13e2b1fa8fc3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Setup\TM-T82X.ini
            Filesize

            27KB

            MD5

            93863cc6ca09a8b348c648e57dd21847

            SHA1

            7e1bc827f18644751b38ead6f29d1b04014b645f

            SHA256

            a16aa5def0ce264035432d8ac0d1e93f140003a2829426d839b162fa58622040

            SHA512

            1fd4260a8ad6367adab8af7cd1cd86a88348bb9d0ecede1a032031426725170a8456f625ded38c2fc407aa57e86cb960f8ae2f0799b9dd382f43a942e6bf7f63

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\APD6\Setup\TPDBase.cab
            Filesize

            83KB

            MD5

            c6484342d8c3b5d215ead8e6801a2847

            SHA1

            87c51c1aa444212574f5ae850d60e2df4981b5bb

            SHA256

            75fea81dac4f52312c84be77c0735194e632ffccdaee2ce8932ba120819add53

            SHA512

            fc7d6e97e1876e8bb81af20c454d3934345daec1459a25154ecc7d4d2455b955d4e83bd266fe1cb7c11f52467e980114d0f0b402ee7997ccfcff255ee932f93b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82X\Resource\English\LA_EN.TXT
            Filesize

            61KB

            MD5

            8aad9997e86b2d19143ec9507566e89e

            SHA1

            75f6fc3662e83fc600f631b282ff49f9a6f58593

            SHA256

            04429ad279e801436898f553afc9ea94b27312d69dec4c73d4584066b3cb8478

            SHA512

            d0c5bc3cd353972017d4c2f9543b35c14c36e861e9106f7ff863ca6423fd6cc8670ae0b38eea701a63348254ffec139b8f73124be9f49804d3caf7983ce4e6aa

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82X\Resource\English\Resource.ini
            Filesize

            11KB

            MD5

            f8259354af1b2b4ad6472e2b4d150463

            SHA1

            8ac9f084c593a6e85d520c3906a708eae55be26d

            SHA256

            4fa0a9ad75baca829fc1170c429e33e3696f054507ee99d72d997c467523a010

            SHA512

            dae5c23d0377d34f2b23fb60d81100ce86deebb9e3e9a7f2f70e681af9f0dbe7fba16b1ee1d56ed17834f26c8bfd7f71f44410469e8c8ddbdf8ddaede82d186d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\EPSON_Advanced_Printer_Driver_6_For_TM-T82X\TPDBase.cab
            Filesize

            83KB

            MD5

            c6484342d8c3b5d215ead8e6801a2847

            SHA1

            87c51c1aa444212574f5ae850d60e2df4981b5bb

            SHA256

            75fea81dac4f52312c84be77c0735194e632ffccdaee2ce8932ba120819add53

            SHA512

            fc7d6e97e1876e8bb81af20c454d3934345daec1459a25154ecc7d4d2455b955d4e83bd266fe1cb7c11f52467e980114d0f0b402ee7997ccfcff255ee932f93b

            Download Submit

          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            9832db2284527955961b54a16b331f4a

            SHA1

            c2e6b10b1beb70d348bf9d3902cd11555b2284e7

            SHA256

            16914bb7268449baba185c4dc0529e97a87801fb49eca998e86d26e3aff2fb41

            SHA512

            d9c023b3daa65863129841d08125f1389231e99fed76453d67f1faada506821216f1f2f2ce84f503dbbc19cf2dc9e380beb789d03f6a141719dfe8ef438053c9

            Download Submit

          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            9832db2284527955961b54a16b331f4a

            SHA1

            c2e6b10b1beb70d348bf9d3902cd11555b2284e7

            SHA256

            16914bb7268449baba185c4dc0529e97a87801fb49eca998e86d26e3aff2fb41

            SHA512

            d9c023b3daa65863129841d08125f1389231e99fed76453d67f1faada506821216f1f2f2ce84f503dbbc19cf2dc9e380beb789d03f6a141719dfe8ef438053c9

            Download Submit

          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
            Filesize

            1.5MB

            MD5

            5b4cad3216e60d32066dc0b89f47afe0

            SHA1

            7e732ad53d1cbb186a6f8ce229f9957d17787526

            SHA256

            ff26d74bd3a1f9fbcf5f63b928dbac5115e8ef254853c3bc46d81b20a54e1bcb

            SHA512

            7f0a3a43d7a870be0dc6ed988263fc2dc126611d2456d2d31072956e21fdf7d8ec643ad37cb136669053b58b4b57f0af4414ba75a9003c2cc8dbe54bf1ce3b89

            Download Submit

          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            7e1e9ada4a47830336851b2d44b2a45b

            SHA1

            7bc8fc15fafb26fd8bebe31e0921c2f9f4bf0927

            SHA256

            0fad88bc4ec170ac8749e56d293ae62173bd5af2dfb187146b1db34587770bcd

            SHA512

            7e131fdcc822f381b4139d9d0fbae1b57dd4007e3d5ecce14037e6be4b9468d1b010848738cb81f93ce29e92f4a47a1ae2ced8ffe1739b4a1fe86394407ab2f4

            Download Submit

          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            7e1e9ada4a47830336851b2d44b2a45b

            SHA1

            7bc8fc15fafb26fd8bebe31e0921c2f9f4bf0927

            SHA256

            0fad88bc4ec170ac8749e56d293ae62173bd5af2dfb187146b1db34587770bcd

            SHA512

            7e131fdcc822f381b4139d9d0fbae1b57dd4007e3d5ecce14037e6be4b9468d1b010848738cb81f93ce29e92f4a47a1ae2ced8ffe1739b4a1fe86394407ab2f4

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            aca7bea9e5fc8bf4df3f05c3909a81d5

            SHA1

            8f30a1a5e8fdc31a51cd75d1f868c7971286d93e

            SHA256

            f09176a003d94b9ec204fd740367b827103480944dbfc97ef8cf491f21e51e87

            SHA512

            872d820ea341fca923b33145ee0f1aa0202d4f68a9dc5bf8d7a71edaf9d2a3adf17009ab97073e01053183ab92c863559d13b765b2eb242b3fc1600f95f2b386

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            aca7bea9e5fc8bf4df3f05c3909a81d5

            SHA1

            8f30a1a5e8fdc31a51cd75d1f868c7971286d93e

            SHA256

            f09176a003d94b9ec204fd740367b827103480944dbfc97ef8cf491f21e51e87

            SHA512

            872d820ea341fca923b33145ee0f1aa0202d4f68a9dc5bf8d7a71edaf9d2a3adf17009ab97073e01053183ab92c863559d13b765b2eb242b3fc1600f95f2b386

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            fe47b16778cb4f60261d6896d732a290

            SHA1

            ebe9a5ace0fd37f7fa69c007dd7c47b9a4f1243e

            SHA256

            7eb891b8c05c0b4fd7c02fb98d73c37b32999f00d0d61e62f217f190bcd36520

            SHA512

            872906b10b8a8605e36efe0cbebbb5e0a6c1e51f05d55f396241657273aa5206106349e8a6cd606bae6a764f421d2ad14fda36c5b3fd782aa3398adfae51998a

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            fe47b16778cb4f60261d6896d732a290

            SHA1

            ebe9a5ace0fd37f7fa69c007dd7c47b9a4f1243e

            SHA256

            7eb891b8c05c0b4fd7c02fb98d73c37b32999f00d0d61e62f217f190bcd36520

            SHA512

            872906b10b8a8605e36efe0cbebbb5e0a6c1e51f05d55f396241657273aa5206106349e8a6cd606bae6a764f421d2ad14fda36c5b3fd782aa3398adfae51998a

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            fe47b16778cb4f60261d6896d732a290

            SHA1

            ebe9a5ace0fd37f7fa69c007dd7c47b9a4f1243e

            SHA256

            7eb891b8c05c0b4fd7c02fb98d73c37b32999f00d0d61e62f217f190bcd36520

            SHA512

            872906b10b8a8605e36efe0cbebbb5e0a6c1e51f05d55f396241657273aa5206106349e8a6cd606bae6a764f421d2ad14fda36c5b3fd782aa3398adfae51998a

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            fe47b16778cb4f60261d6896d732a290

            SHA1

            ebe9a5ace0fd37f7fa69c007dd7c47b9a4f1243e

            SHA256

            7eb891b8c05c0b4fd7c02fb98d73c37b32999f00d0d61e62f217f190bcd36520

            SHA512

            872906b10b8a8605e36efe0cbebbb5e0a6c1e51f05d55f396241657273aa5206106349e8a6cd606bae6a764f421d2ad14fda36c5b3fd782aa3398adfae51998a

            Download Submit

          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            fe47b16778cb4f60261d6896d732a290

            SHA1

            ebe9a5ace0fd37f7fa69c007dd7c47b9a4f1243e

            SHA256

            7eb891b8c05c0b4fd7c02fb98d73c37b32999f00d0d61e62f217f190bcd36520

            SHA512

            872906b10b8a8605e36efe0cbebbb5e0a6c1e51f05d55f396241657273aa5206106349e8a6cd606bae6a764f421d2ad14fda36c5b3fd782aa3398adfae51998a

            Download Submit

          • C:\Windows\SysWOW64\perfhost.exe
            Filesize

            1.5MB

            MD5

            2334eece2d5d9cbd4650fe8fb8ac55cc

            SHA1

            0ec7cffd536ff1a9f058a51e4a1e43f9c52dd7fe

            SHA256

            ad169896efe0fa706ad7c6e51712e5f0fc3236788ee08bd7389bab21f13b0397

            SHA512

            53c91cfdc163ec81167dc57919d44d748a8a44a33ecfa1c9cce2680e91ba0b8b22d721bf71a361a13daca9195b925f64e2e662c05f907ffdb3ea0eb342ca9431

            Download Submit

          • C:\Windows\System32\Locator.exe
            Filesize

            1.4MB

            MD5

            0543a266642a904e6da0c126ac622e45

            SHA1

            b402b4a1054308d0be83aa43ceb3e8d88924e596

            SHA256

            fbf5afdf9ebc738df5ecd0391774c8b036e0b52cc3162da9982fe93099d1bbae

            SHA512

            b79656a3cd34ca914475f13e20134f4c42d661fdf9a80f8615f744b2d96ecaa3ef0e173cbd99451886ee86ea5a524367947eb2b1e24a25aff1ea6da5e395d1e0

            Download Submit

          • C:\Windows\System32\VSSVC.exe
            Filesize

            2.1MB

            MD5

            64b3dd008f80f2bbc0a8df4a0aaf114d

            SHA1

            694c0ed28e973a39e63360a441c900f6f2f2d084

            SHA256

            afaddffe06c18b5dac163138b3ebbdc358c624f4890d2d1c66100a7d667eab6e

            SHA512

            0b414d6b9ebcbe4e70870bc6125afe27faf2d0af73583001f3fe24bdb7275e421fb81f80dfa41cf70c3b674236ddaf8c9d05d5f5764324666fa1b2e0efd1dd0e

            Download Submit

          • C:\Windows\System32\alg.exe
            Filesize

            1.5MB

            MD5

            539c2d586f2514b456eecff87b8f01f8

            SHA1

            78ff157cf5d4248d6aa390430f4e1683c1a40048

            SHA256

            0450e52e1a3cdb0e8dccf76e38521c207c3965537bb2fdacb09294b0d5582ef3

            SHA512

            0e85f13cccb0c0c26da7f3a7848e98ec016749ad73cb82b46f83106c23cf9afc337568273802e86e583337a6fb6f51f6c2a364dc0b4ea2019161816b50a9c09a

            Download Submit

          • C:\Windows\System32\dllhost.exe
            Filesize

            1.4MB

            MD5

            96d884e174afac96d8a612204249c3c5

            SHA1

            5b048f02f58c41284de0b45167bd18c6affdb20b

            SHA256

            b9ffab95f95158a7a2b8ca7db367f61c995c4a66d28a5f8f0057ac36c95c00ef

            SHA512

            a5d46650ef137cec7fdaca6ac4fb5eee59da1d788648683f33013c9a9631968db62055da4cbebef110aa87129e885bd882a4e8abfa642b0cf8b3268d94f729d6

            Download Submit

          • C:\Windows\System32\ieetwcollector.exe
            Filesize

            1.5MB

            MD5

            ed91677c4d405a82e5339568a635045c

            SHA1

            bd2a184bfa6b58aed39638aec2427bb8f80bf35b

            SHA256

            5bdb3c2fe801101e8f20404dd92d83bec295995c743bbead52c0b890349ef54f

            SHA512

            a3daaf9a815578453a0065355d566beacae752cf9e15805f4beeeb093a7c674fd9938c845cab6a7ee7fc044bb5bc1062db190c913a68cd00e1ec5fb1d659b4ba

            Download Submit

          • C:\Windows\System32\msdtc.exe
            Filesize

            1.6MB

            MD5

            b34493d2529f5bc6c1f85b168e0cae8a

            SHA1

            3f1ff6383a57ba0c695c9097c7412ade7a124fea

            SHA256

            660cd0df8ee6df710a2e330cc7d9d806c1c61082f7e40e2801c0b9471491afb7

            SHA512

            0881b3f0f86c345175c3ac88cbcb454e9039b6f04ec0ccddd4c31ba620e0373d0c86df9f33374379938fbf41e5d507039c88e5015e87ff177a060007a3ad2939

            Download Submit

          • C:\Windows\System32\msiexec.exe
            Filesize

            1.6MB

            MD5

            c03c9b7c241581862357e78c7fb06d35

            SHA1

            335eb2a38f7af6fef8e16ecf397a287e149651db

            SHA256

            027c2387956fe280bccde8801bf5b22e7f7a4c08d5d0931273120c66c7c58390

            SHA512

            3baec15d39970609e93cdda9e7dd27886546f1358a25a10f46a37739a42fb9fdb9a0afb460965b1e3ef6c56b8ab56ba4badd8f626f3b0da72d6ec8941c32c356

            Download Submit

          • C:\Windows\System32\snmptrap.exe
            Filesize

            1.4MB

            MD5

            5a9057c2989ebbc2552726ced61b50b5

            SHA1

            08c8b2e6c17973f546803bac17cbc035f5d4257e

            SHA256

            fca33d9ab129e995387d5781362047d157c823ca180645ee48771d1d9ac853a2

            SHA512

            21f0638506009bf7acdea4eeba76f087db663b3d14e40166bf7b23db824e3577df9538ddc3946d66ee105f9fc629ad85b40415186d348ae0c47cd10bc7f9d846

            Download Submit

          • C:\Windows\System32\vds.exe
            Filesize

            1.9MB

            MD5

            1cb6853df05b519281218faa86fbfd75

            SHA1

            53d864fb42c5c421179034837543e874a7ea4cba

            SHA256

            ac215ccb6605149d3875b73c2bc0722a7be9c657239138ab09d9c60ab0f12c40

            SHA512

            a104b62784707eb21e3306213deff604d357bac4a436714d1a4a2a9f1095fbaf35f62bb1a16f3b443a1dcf155e77cd1f64ce850785fd843d50d0f2a4014b3c25

            Download Submit

          • C:\Windows\System32\wbem\WmiApSrv.exe
            Filesize

            1.6MB

            MD5

            8767eaf4789d3ca2625e8d978703227e

            SHA1

            eeb6cdbdb00641c8618711edd76e579c4ce5d0a9

            SHA256

            15526723224d8273c7b99e211de6ba5eeb51892e40f37164c24ee0e21aea416f

            SHA512

            e06a7e780a17738c6489ba16a987b5f7113c7f422a86a4754c72bd1458b108ec0b5ae6786a1e854ad0ce85d7aba1bad5888723b2eec13ac2ae1f819b262fef86

            Download Submit

          • C:\Windows\System32\wbengine.exe
            Filesize

            2.0MB

            MD5

            9fc5eadccb7f44e639c41ba1747be1ec

            SHA1

            caa2e640e46d9f6f934ef6ee12ad0d4f5c130771

            SHA256

            5c40a9f0e6cbed706b6fe976ffb66f9ed3f76e5af69b8e1f24a30dc841b9ba11

            SHA512

            1751486669a49f91ab1157bcdfb69fcfe763d8be7cf9f74b095084bc0100ad0f697235c0d24660dc7a624bc54a19ecbb62c76d2d5ae2a717190636a083ac0ea9

            Download Submit

          • C:\Windows\ehome\ehrecvr.exe
            Filesize

            1.2MB

            MD5

            549fc7e64a8b24064d580e31c2f23d04

            SHA1

            cf858a9db4c1c0ded38e1590f6d4b14819c20c39

            SHA256

            9a97c7b332d06f977d4172c3f3603a0ebfa7ab918e88153614eeff45f08c730e

            SHA512

            6532485f2d0f6b6df9ca27810ea61ea33ac12e8d49ddc87c5f1feeb4bed1014040819d865b7765c937cd9af8412a703f41d7d05b9c1d698d692125f681a4490f

            Download Submit

          • C:\Windows\ehome\ehsched.exe
            Filesize

            1.6MB

            MD5

            8a8a322d9188ed09f8011ab076d1de47

            SHA1

            a72c97ad62a769f959e4debc334a6e20155eca95

            SHA256

            064e0318b5e0e1b6464854546c7bdc61c5370e9eeed73fe66f99fd455af9704f

            SHA512

            30e42b7f36ba275f111dbee6d7be8022cecc47ce33c8272fc5250141a1cdd152859c176c715a1bc2ebd99245f9663ee8d87b83d0f0509d98fb82be58b5821833

            Download Submit

          • C:\Windows\system32\msiexec.exe
            Filesize

            1.6MB

            MD5

            c03c9b7c241581862357e78c7fb06d35

            SHA1

            335eb2a38f7af6fef8e16ecf397a287e149651db

            SHA256

            027c2387956fe280bccde8801bf5b22e7f7a4c08d5d0931273120c66c7c58390

            SHA512

            3baec15d39970609e93cdda9e7dd27886546f1358a25a10f46a37739a42fb9fdb9a0afb460965b1e3ef6c56b8ab56ba4badd8f626f3b0da72d6ec8941c32c356

            Download Submit

          • \Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
            Filesize

            2.0MB

            MD5

            51b3ad264a23b6f4d52a6d3c643baa2c

            SHA1

            c766542d7d268eb2552994c247ec59017db70358

            SHA256

            09529a18fc9bc88ffdc50d31e2949fa44306571b530a9dc102d0b1a12f337099

            SHA512

            dc39735a798b39765937bd2509e4d457640c2b600dbbfafe6207f80f3da8835fc3f4aef1bf1ef44e2027f35b2230e5330c75e22b9bb50692315efb8b79aa438e

            Download Submit

          • \Users\Admin\AppData\Local\Temp\APD6\Setup\Setup.exe
            Filesize

            829KB

            MD5

            fba8adddc1391ef3b27c160e62a38b7a

            SHA1

            2b361c917b3356e4831f31994b853b24a35d7f56

            SHA256

            36c8a7a911da1148ffa3257ad6e9f82c59d5325325ab2545d9cc754d7bb43f31

            SHA512

            99df725b645ffb63dfda063fb12d0a7c9109ef32d37e9c28eed24c6267d494daed47c9e8d0ef5e0f874c5e154f0f385b44ff7442018b018e3b6e13e2b1fa8fc3

            Download Submit

          • \Users\Admin\AppData\Local\Temp\APD6\UnZip32.Dll
            Filesize

            116KB

            MD5

            5513818fcb92467c79c407c4752334f8

            SHA1

            15972c6f5d88ec55a8850fa3b5148c48b7624786

            SHA256

            4c0846d86c37f7aff9708a6235e8a06f96acb0ed5b8203b4c91ee86dbb71ad14

            SHA512

            fad8bea8dbb9cacb7ecfd55f4c65b4c3a0f40f68575a78d35cb47bfa176a69f48e225f70f08c625b3af27109e2b66f8d44a6881e8509d9dd05ce769b8d5dfd97

            Download Submit

          • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
            Filesize

            1.5MB

            MD5

            9832db2284527955961b54a16b331f4a

            SHA1

            c2e6b10b1beb70d348bf9d3902cd11555b2284e7

            SHA256

            16914bb7268449baba185c4dc0529e97a87801fb49eca998e86d26e3aff2fb41

            SHA512

            d9c023b3daa65863129841d08125f1389231e99fed76453d67f1faada506821216f1f2f2ce84f503dbbc19cf2dc9e380beb789d03f6a141719dfe8ef438053c9

            Download Submit

          • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
            Filesize

            1.5MB

            MD5

            5b4cad3216e60d32066dc0b89f47afe0

            SHA1

            7e732ad53d1cbb186a6f8ce229f9957d17787526

            SHA256

            ff26d74bd3a1f9fbcf5f63b928dbac5115e8ef254853c3bc46d81b20a54e1bcb

            SHA512

            7f0a3a43d7a870be0dc6ed988263fc2dc126611d2456d2d31072956e21fdf7d8ec643ad37cb136669053b58b4b57f0af4414ba75a9003c2cc8dbe54bf1ce3b89

            Download Submit

          • \Windows\System32\Locator.exe
            Filesize

            1.4MB

            MD5

            0543a266642a904e6da0c126ac622e45

            SHA1

            b402b4a1054308d0be83aa43ceb3e8d88924e596

            SHA256

            fbf5afdf9ebc738df5ecd0391774c8b036e0b52cc3162da9982fe93099d1bbae

            SHA512

            b79656a3cd34ca914475f13e20134f4c42d661fdf9a80f8615f744b2d96ecaa3ef0e173cbd99451886ee86ea5a524367947eb2b1e24a25aff1ea6da5e395d1e0

            Download Submit

          • \Windows\System32\alg.exe
            Filesize

            1.5MB

            MD5

            539c2d586f2514b456eecff87b8f01f8

            SHA1

            78ff157cf5d4248d6aa390430f4e1683c1a40048

            SHA256

            0450e52e1a3cdb0e8dccf76e38521c207c3965537bb2fdacb09294b0d5582ef3

            SHA512

            0e85f13cccb0c0c26da7f3a7848e98ec016749ad73cb82b46f83106c23cf9afc337568273802e86e583337a6fb6f51f6c2a364dc0b4ea2019161816b50a9c09a

            Download Submit

          • \Windows\System32\dllhost.exe
            Filesize

            1.4MB

            MD5

            96d884e174afac96d8a612204249c3c5

            SHA1

            5b048f02f58c41284de0b45167bd18c6affdb20b

            SHA256

            b9ffab95f95158a7a2b8ca7db367f61c995c4a66d28a5f8f0057ac36c95c00ef

            SHA512

            a5d46650ef137cec7fdaca6ac4fb5eee59da1d788648683f33013c9a9631968db62055da4cbebef110aa87129e885bd882a4e8abfa642b0cf8b3268d94f729d6

            Download Submit

          • \Windows\System32\ieetwcollector.exe
            Filesize

            1.5MB

            MD5

            ed91677c4d405a82e5339568a635045c

            SHA1

            bd2a184bfa6b58aed39638aec2427bb8f80bf35b

            SHA256

            5bdb3c2fe801101e8f20404dd92d83bec295995c743bbead52c0b890349ef54f

            SHA512

            a3daaf9a815578453a0065355d566beacae752cf9e15805f4beeeb093a7c674fd9938c845cab6a7ee7fc044bb5bc1062db190c913a68cd00e1ec5fb1d659b4ba

            Download Submit

          • \Windows\System32\msdtc.exe
            Filesize

            1.6MB

            MD5

            b34493d2529f5bc6c1f85b168e0cae8a

            SHA1

            3f1ff6383a57ba0c695c9097c7412ade7a124fea

            SHA256

            660cd0df8ee6df710a2e330cc7d9d806c1c61082f7e40e2801c0b9471491afb7

            SHA512

            0881b3f0f86c345175c3ac88cbcb454e9039b6f04ec0ccddd4c31ba620e0373d0c86df9f33374379938fbf41e5d507039c88e5015e87ff177a060007a3ad2939

            Download Submit

          • \Windows\System32\msiexec.exe
            Filesize

            1.6MB

            MD5

            c03c9b7c241581862357e78c7fb06d35

            SHA1

            335eb2a38f7af6fef8e16ecf397a287e149651db

            SHA256

            027c2387956fe280bccde8801bf5b22e7f7a4c08d5d0931273120c66c7c58390

            SHA512

            3baec15d39970609e93cdda9e7dd27886546f1358a25a10f46a37739a42fb9fdb9a0afb460965b1e3ef6c56b8ab56ba4badd8f626f3b0da72d6ec8941c32c356

            Download Submit

          • \Windows\System32\msiexec.exe
            Filesize

            1.6MB

            MD5

            c03c9b7c241581862357e78c7fb06d35

            SHA1

            335eb2a38f7af6fef8e16ecf397a287e149651db

            SHA256

            027c2387956fe280bccde8801bf5b22e7f7a4c08d5d0931273120c66c7c58390

            SHA512

            3baec15d39970609e93cdda9e7dd27886546f1358a25a10f46a37739a42fb9fdb9a0afb460965b1e3ef6c56b8ab56ba4badd8f626f3b0da72d6ec8941c32c356

            Download Submit

          • \Windows\System32\snmptrap.exe
            Filesize

            1.4MB

            MD5

            5a9057c2989ebbc2552726ced61b50b5

            SHA1

            08c8b2e6c17973f546803bac17cbc035f5d4257e

            SHA256

            fca33d9ab129e995387d5781362047d157c823ca180645ee48771d1d9ac853a2

            SHA512

            21f0638506009bf7acdea4eeba76f087db663b3d14e40166bf7b23db824e3577df9538ddc3946d66ee105f9fc629ad85b40415186d348ae0c47cd10bc7f9d846

            Download Submit

          • \Windows\System32\vds.exe
            Filesize

            1.9MB

            MD5

            1cb6853df05b519281218faa86fbfd75

            SHA1

            53d864fb42c5c421179034837543e874a7ea4cba

            SHA256

            ac215ccb6605149d3875b73c2bc0722a7be9c657239138ab09d9c60ab0f12c40

            SHA512

            a104b62784707eb21e3306213deff604d357bac4a436714d1a4a2a9f1095fbaf35f62bb1a16f3b443a1dcf155e77cd1f64ce850785fd843d50d0f2a4014b3c25

            Download Submit

          • \Windows\System32\wbem\WmiApSrv.exe
            Filesize

            1.6MB

            MD5

            8767eaf4789d3ca2625e8d978703227e

            SHA1

            eeb6cdbdb00641c8618711edd76e579c4ce5d0a9

            SHA256

            15526723224d8273c7b99e211de6ba5eeb51892e40f37164c24ee0e21aea416f

            SHA512

            e06a7e780a17738c6489ba16a987b5f7113c7f422a86a4754c72bd1458b108ec0b5ae6786a1e854ad0ce85d7aba1bad5888723b2eec13ac2ae1f819b262fef86

            Download Submit

          • \Windows\System32\wbengine.exe
            Filesize

            2.0MB

            MD5

            9fc5eadccb7f44e639c41ba1747be1ec

            SHA1

            caa2e640e46d9f6f934ef6ee12ad0d4f5c130771

            SHA256

            5c40a9f0e6cbed706b6fe976ffb66f9ed3f76e5af69b8e1f24a30dc841b9ba11

            SHA512

            1751486669a49f91ab1157bcdfb69fcfe763d8be7cf9f74b095084bc0100ad0f697235c0d24660dc7a624bc54a19ecbb62c76d2d5ae2a717190636a083ac0ea9

            Download Submit

          • \Windows\ehome\ehrecvr.exe
            Filesize

            1.2MB

            MD5

            549fc7e64a8b24064d580e31c2f23d04

            SHA1

            cf858a9db4c1c0ded38e1590f6d4b14819c20c39

            SHA256

            9a97c7b332d06f977d4172c3f3603a0ebfa7ab918e88153614eeff45f08c730e

            SHA512

            6532485f2d0f6b6df9ca27810ea61ea33ac12e8d49ddc87c5f1feeb4bed1014040819d865b7765c937cd9af8412a703f41d7d05b9c1d698d692125f681a4490f

            Download Submit

          • \Windows\ehome\ehsched.exe
            Filesize

            1.6MB

            MD5

            8a8a322d9188ed09f8011ab076d1de47

            SHA1

            a72c97ad62a769f959e4debc334a6e20155eca95

            SHA256

            064e0318b5e0e1b6464854546c7bdc61c5370e9eeed73fe66f99fd455af9704f

            SHA512

            30e42b7f36ba275f111dbee6d7be8022cecc47ce33c8272fc5250141a1cdd152859c176c715a1bc2ebd99245f9663ee8d87b83d0f0509d98fb82be58b5821833

            Download Submit

          • memory/668-133-0x0000000000000000-mapping.dmp

            Download

          • memory/748-479-0x0000000000000000-mapping.dmp

            Download

          • memory/748-88-0x0000000010000000-0x0000000010188000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/856-74-0x0000000100000000-0x0000000100185000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/856-75-0x00000000007C0000-0x0000000000820000-memory.dmp

            Filesize

            384KB

            Download

          • memory/856-62-0x00000000007C0000-0x0000000000820000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1020-419-0x0000000000000000-mapping.dmp

            Download

          • memory/1100-505-0x0000000000000000-mapping.dmp

            Download

          • memory/1140-116-0x0000000000A80000-0x0000000000AE0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1140-98-0x0000000000A80000-0x0000000000AE0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1140-115-0x0000000140000000-0x000000014018F000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/1224-54-0x0000000076941000-0x0000000076943000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1224-73-0x0000000000390000-0x00000000003F7000-memory.dmp

            Filesize

            412KB

            Download

          • memory/1224-55-0x0000000000390000-0x00000000003F7000-memory.dmp

            Filesize

            412KB

            Download

          • memory/1224-72-0x0000000000400000-0x0000000000D53000-memory.dmp

            Filesize

            9.3MB

            Download

          • memory/1332-637-0x0000000000000000-mapping.dmp

            Download

          • memory/1392-577-0x0000000000000000-mapping.dmp

            Download

          • memory/1392-495-0x0000000000000000-mapping.dmp

            Download

          • memory/1440-647-0x0000000000000000-mapping.dmp

            Download

          • memory/1492-232-0x0000000140000000-0x000000014017E000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1492-76-0x0000000140000000-0x000000014017E000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1532-152-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1532-327-0x0000000140000000-0x000000014020E000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/1532-170-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1532-157-0x0000000140000000-0x000000014020E000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/1544-141-0x0000000000290000-0x00000000002F0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1544-153-0x0000000140000000-0x0000000140193000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/1544-326-0x0000000140000000-0x0000000140193000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/1544-155-0x0000000000290000-0x00000000002F0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1548-78-0x00000000005B0000-0x0000000000617000-memory.dmp

            Filesize

            412KB

            Download

          • memory/1548-86-0x0000000010000000-0x0000000010180000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1548-87-0x00000000005B0000-0x0000000000617000-memory.dmp

            Filesize

            412KB

            Download

          • memory/1612-171-0x0000000140000000-0x000000014018F000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/1612-164-0x0000000000820000-0x0000000000880000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1612-172-0x0000000000820000-0x0000000000880000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1648-149-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1652-443-0x0000000000000000-mapping.dmp

            Download

          • memory/1656-404-0x0000000000000000-mapping.dmp

            Download

          • memory/1696-569-0x0000000000000000-mapping.dmp

            Download

          • memory/1712-545-0x0000000000000000-mapping.dmp

            Download

          • memory/1736-138-0x0000000000170000-0x00000000001D0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1736-144-0x0000000001390000-0x00000000013A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1736-142-0x0000000001380000-0x0000000001390000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1736-137-0x0000000140000000-0x000000014013C000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1736-125-0x0000000000170000-0x00000000001D0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1736-299-0x0000000140000000-0x000000014013C000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/1752-117-0x0000000100000000-0x0000000100176000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1752-136-0x00000000008B0000-0x0000000000910000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1752-106-0x00000000008B0000-0x0000000000910000-memory.dmp

            Filesize

            384KB

            Download

          • memory/1756-161-0x000007FEF3600000-0x000007FEF4023000-memory.dmp

            Filesize

            10.1MB

            Download

          • memory/1760-553-0x0000000000000000-mapping.dmp

            Download

          • memory/1796-118-0x0000000000000000-mapping.dmp

            Download

          • memory/1796-348-0x0000000000250000-0x000000000025F000-memory.dmp

            Filesize

            60KB

            Download

          • memory/1796-349-0x0000000000250000-0x000000000025F000-memory.dmp

            Filesize

            60KB

            Download

          • memory/1828-528-0x0000000000000000-mapping.dmp

            Download

          • memory/1872-189-0x0000000000A30000-0x0000000000A97000-memory.dmp

            Filesize

            412KB

            Download

          • memory/1872-176-0x000000002E000000-0x000000002FE1E000-memory.dmp

            Filesize

            30.1MB

            Download

          • memory/1936-113-0x0000000000390000-0x00000000003F7000-memory.dmp

            Filesize

            412KB

            Download

          • memory/1936-112-0x0000000000400000-0x0000000000589000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1944-604-0x0000000000000000-mapping.dmp

            Download

          • memory/2068-421-0x0000000000000000-mapping.dmp

            Download

          • memory/2068-586-0x0000000000000000-mapping.dmp

            Download

          • memory/2092-202-0x00000000006C0000-0x0000000000727000-memory.dmp

            Filesize

            412KB

            Download

          • memory/2092-190-0x0000000000400000-0x0000000000589000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2092-182-0x0000000000000000-mapping.dmp

            Download

          • memory/2092-213-0x0000000000400000-0x0000000000589000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2128-328-0x0000000100000000-0x0000000100219000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/2128-329-0x0000000000390000-0x00000000003F0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2164-403-0x0000000000000000-mapping.dmp

            Download

          • memory/2168-199-0x0000000000BD0000-0x0000000000C30000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2168-198-0x0000000140000000-0x00000001401B0000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/2196-594-0x0000000000000000-mapping.dmp

            Download

          • memory/2196-512-0x0000000000000000-mapping.dmp

            Download

          • memory/2232-331-0x0000000000870000-0x00000000008D0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2232-330-0x0000000100000000-0x0000000100202000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2260-462-0x0000000000000000-mapping.dmp

            Download

          • memory/2268-520-0x0000000000000000-mapping.dmp

            Download

          • memory/2288-227-0x0000000000820000-0x0000000000880000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2288-203-0x0000000140000000-0x0000000140197000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/2308-346-0x00000000007B0000-0x0000000000810000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2308-332-0x0000000100000000-0x00000001001A5000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/2372-223-0x0000000000670000-0x00000000006D7000-memory.dmp

            Filesize

            412KB

            Download

          • memory/2372-229-0x0000000000400000-0x0000000000589000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2372-241-0x0000000000400000-0x0000000000589000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2372-210-0x0000000000000000-mapping.dmp

            Download

          • memory/2376-406-0x0000000000000000-mapping.dmp

            Download

          • memory/2376-621-0x0000000000000000-mapping.dmp

            Download

          • memory/2380-432-0x0000000000000000-mapping.dmp

            Download

          • memory/2440-248-0x00000000004D0000-0x0000000000663000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/2440-251-0x00000000004D0000-0x0000000000663000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/2440-225-0x0000000100000000-0x0000000100193000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/2460-562-0x0000000000000000-mapping.dmp

            Download

          • memory/2472-408-0x0000000000000000-mapping.dmp

            Download

          • memory/2472-454-0x0000000000000000-mapping.dmp

            Download

          • memory/2536-233-0x0000000000000000-mapping.dmp

            Download

          • memory/2536-252-0x0000000000400000-0x0000000000589000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2548-347-0x0000000100000000-0x000000010020A000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/2616-249-0x000000002E000000-0x000000002E196000-memory.dmp

            Filesize

            1.6MB

            Download

          • memory/2616-250-0x00000000003D0000-0x0000000000437000-memory.dmp

            Filesize

            412KB

            Download

          • memory/2716-612-0x0000000000000000-mapping.dmp

            Download

          • memory/2716-437-0x0000000000000000-mapping.dmp

            Download

          • memory/2732-284-0x0000000073DA8000-0x0000000073DBD000-memory.dmp

            Filesize

            84KB

            Download

          • memory/2732-266-0x0000000100000000-0x0000000100542000-memory.dmp

            Filesize

            5.3MB

            Download

          • memory/2732-267-0x0000000000830000-0x0000000000890000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2772-410-0x0000000000000000-mapping.dmp

            Download

          • memory/2804-269-0x0000000000470000-0x00000000004D7000-memory.dmp

            Filesize

            412KB

            Download

          • memory/2804-268-0x0000000001000000-0x0000000001177000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2852-536-0x0000000000000000-mapping.dmp

            Download

          • memory/2852-470-0x0000000000000000-mapping.dmp

            Download

          • memory/2872-286-0x0000000000350000-0x00000000003B0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2872-282-0x0000000100000000-0x0000000100176000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2892-487-0x0000000000000000-mapping.dmp

            Download

          • memory/2932-288-0x0000000100000000-0x0000000100177000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2932-300-0x0000000000380000-0x00000000003E0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/3028-301-0x0000000100000000-0x00000001001F5000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/3028-303-0x00000000003C0000-0x0000000000420000-memory.dmp

            Filesize

            384KB

            Download