Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2023, 11:55

General

  • Target

    Purchase Order 202319876.exe

  • Size

    1.5MB

  • MD5

    b3b47f7fd1fad3e0d79c8d20a5bd57b0

  • SHA1

    dcb8e21d45e9b6a1b9408b67866f79c191e0122c

  • SHA256

    df2a21acbf5abb55445a48a442b6245205ec80e36bb861aadd47ee18e4d132f2

  • SHA512

    3e711ff9895ee2f627c79ef089ff9955c5b73ba3fc05787e66fb635159e7737d95c67b79606a5d8cea7e0f37962989f8332221aec79d08a64564ce4d3a0b9226

  • SSDEEP

    24576:eTJyekkXDVzThJ68yj42MiIsMcGOKJvADSiBHYcOvCedKERBx4HoHvguqT+z:YjXRf76hsZiZGFJ4DSImvC3ERBZv5pz

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 17 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 29 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
      "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:920
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:1848
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:820
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:968
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1432
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 184 -NGENProcess 1b0 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3004
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 264 -NGENProcess 1b0 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2440
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2012
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 1ec -NGENProcess 1cc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2152
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1680
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1396
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:2008
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:824
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1732
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1812
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:1552
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1712
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2096
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2212
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2368
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2548
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2584
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:2680
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:2708
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:2800
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:2908
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2984
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2120
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:2168
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2500
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    PID:2652

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

          Filesize

          1.4MB

          MD5

          a056e08f179f5f3c37a7c0aa7c721f00

          SHA1

          940afc444d8f40bbd730aa034f6fcbe86ca640de

          SHA256

          838389c4bc4a74ec3fbf927fc6abc7b6e14fbb7f7d4b675e66acfc7cf2f537b4

          SHA512

          9664bc5d7d922af779e6990521f22f50b6ffaea7fed4ed6f612ad7458175770cbda0226b81a4fc43de61b99c5f5d94996ccebdcd2becd8d857d5267323b8c56d

        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

          Filesize

          30.1MB

          MD5

          9c3dbb3827767a0fd124f59f986314d8

          SHA1

          25c45e513fd42e2d5f3ec04d4a3b4646c20926d7

          SHA256

          06b2e2ccc03d1cb383c2fbb47f0d8f31d27bed55ea3f22284782cf0122bb2821

          SHA512

          47771186230711862a085b730fe601b1f9bb47ffff8ddd88666cbacf9d0df05f36654b32e70c7f2bf51b16d8b315b6b01c0cec48bba4e271616cc183656d397b

        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

          Filesize

          1.4MB

          MD5

          b96d694fda3082a2c421f1490d0acfd9

          SHA1

          f8323e417bb91fdfa4bf23759813796956f660d3

          SHA256

          de74f877b07f198b5716b1ed55613a986e7a9eb1b4413a7ea5df5dd2539a98a0

          SHA512

          3591fe51129bd404a1d5aca1e78416bdb0eed82b44160911dad422e3b1c8fd36f834bca2b4fd80dc5539be4a7d9e5984d5532fa3b1c1ff773856bc420730f26e

        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

          Filesize

          5.2MB

          MD5

          e8adfc62085749b88db0443003592d84

          SHA1

          bdd25f668a1b7938b2aa7b0bb7d069f434f309ab

          SHA256

          e777e1a2aaea9a52b438fd3775a151c68b9f15c55580e2423b04c62e92b46c30

          SHA512

          073937ac5d0d9ad2e1a19292ff21904acbcf89c2402bff3c430894a5c559ef84bb96ec4806d469979beef8463f8d41381c7eb682ef4cd9e57c43f6ca278c238b

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

          Filesize

          2.1MB

          MD5

          010f93f5aab50b646c3ca66713142fce

          SHA1

          f863f8319e115d455f937f02ca8916614c7c0f6d

          SHA256

          982b05bfae9cca3f174ff8f1ca3f0e6e117878ee6f1f943d87cb50fad8ecde25

          SHA512

          44ad807b14d75193218d2abb267bf34815896b9a9ba5326b6f262cd357810173074abd6eba9c6d1dfc32a6142d9983c81ca6733608f9f5e0b904de257a23eeac

        • C:\Program Files\Windows Media Player\wmpnetwk.exe

          Filesize

          2.0MB

          MD5

          e559b478dec21c1ae0c42e043622e1db

          SHA1

          add8d9f1af8b090addf15899ce7e9d9a64f62dfa

          SHA256

          cc71155a37b2919956edfada333c7d6ea942f0263afea632802338eb3dd01e27

          SHA512

          b5aa9d343f18dbef84b0378649c12c36737452cd1cefc3b3de582b4df162680ffa04ee548a7a9580e1315e77a98b135489ff005bef9a9ce19847d0064abc4507

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          0369a4f9e8adfd1f6f8e6c38b609d524

          SHA1

          f1b2a5d060d7411b90b150675dd07f490fea9f78

          SHA256

          e808eae38750114252f64dd9077cac1015d55bfd5847c8c6ad9672ca3304d5d8

          SHA512

          7e66bdb15214573be9f85af90dc111d92b7d9dd24318279282fbc5612d57fc0dc1d31c167abd7dc3ddd9c30a58879200cc3af298ec534b71d1f761a6c4dcbcef

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          0369a4f9e8adfd1f6f8e6c38b609d524

          SHA1

          f1b2a5d060d7411b90b150675dd07f490fea9f78

          SHA256

          e808eae38750114252f64dd9077cac1015d55bfd5847c8c6ad9672ca3304d5d8

          SHA512

          7e66bdb15214573be9f85af90dc111d92b7d9dd24318279282fbc5612d57fc0dc1d31c167abd7dc3ddd9c30a58879200cc3af298ec534b71d1f761a6c4dcbcef

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

          Filesize

          872KB

          MD5

          e24a09532d6ae2ec0bd503eb33e2463b

          SHA1

          66e98f03e376c8bcc23c5d654296e62ae7e3429a

          SHA256

          91fe5b486a7f514bfad992e18312836fbd31edbed6d80a579ee857ef4970766c

          SHA512

          f1bc1ba7bb178ce9153b590139a4cdbe0be0ef31a0336f65108909cba2e1339ef9f819ab011f43f8a84cab8237e26cf5afa19152ee23cc7ae141a348f7e29f7d

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

          Filesize

          1.3MB

          MD5

          53691ba15c94f286713c2e3f5622421e

          SHA1

          115d20aed6b3f9eb719919dc0416a2ee6eaa20d0

          SHA256

          d2ae4ade3fe23c490adb3943aa36fbca644ef2266b5bedaadf6151ad4fa6f6dc

          SHA512

          6735fa5b067ff667f3eb93e92a8e0d0d41149b5125800779fb817700f34b1f0708c6162b0bb57452aff243390b4130e6b23e0906675a54dc93648623b467fb32

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          b979d1a3c92da9a981ce919a1e5388e8

          SHA1

          3df5678279741d46b237660302d90ec766d6229f

          SHA256

          8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d

          SHA512

          4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          b979d1a3c92da9a981ce919a1e5388e8

          SHA1

          3df5678279741d46b237660302d90ec766d6229f

          SHA256

          8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d

          SHA512

          4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          b979d1a3c92da9a981ce919a1e5388e8

          SHA1

          3df5678279741d46b237660302d90ec766d6229f

          SHA256

          8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d

          SHA512

          4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          b979d1a3c92da9a981ce919a1e5388e8

          SHA1

          3df5678279741d46b237660302d90ec766d6229f

          SHA256

          8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d

          SHA512

          4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          822ceaef695b0b7660e8ebfa2042dbad

          SHA1

          a77df9c35f8587c76ed16c1591e0e04b47908a32

          SHA256

          1367a16bcce1fa149ad1219904deb7e0c63ca0452bbc968bada55509a88dc76a

          SHA512

          8da4010ccaf1aeb76bc6045a5023008845e6da630f069fc9bbcb091dbaab2b2d9e593c4a934cea7d45fe5d8ec26005db8566e8d9f11c9d35259a88673cc9ccdc

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          822ceaef695b0b7660e8ebfa2042dbad

          SHA1

          a77df9c35f8587c76ed16c1591e0e04b47908a32

          SHA256

          1367a16bcce1fa149ad1219904deb7e0c63ca0452bbc968bada55509a88dc76a

          SHA512

          8da4010ccaf1aeb76bc6045a5023008845e6da630f069fc9bbcb091dbaab2b2d9e593c4a934cea7d45fe5d8ec26005db8566e8d9f11c9d35259a88673cc9ccdc

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

          Filesize

          1003KB

          MD5

          50b325e4a89091a924380dd1e5b121c1

          SHA1

          5684a1eea217c5895020cc1553891768be277cfb

          SHA256

          6d6da2255d0ee12044778469548f3292ccfa67627c80e51c0a7677a5a0c27b8c

          SHA512

          435ca83a80532f89a1df1dc9fb30034a94914f8bcebb6a2237fa4ddd0d1db40f4318d80c8fcd4fe7d25a1689b79a9c6aacd2924a452c72d93fa69a4aaaf5f0f9

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          6b4ee5bf44e795f3e895872b1751c79b

          SHA1

          d71405f09ba8923f888d5ed18ff875babade6d1e

          SHA256

          34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95

          SHA512

          a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          6b4ee5bf44e795f3e895872b1751c79b

          SHA1

          d71405f09ba8923f888d5ed18ff875babade6d1e

          SHA256

          34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95

          SHA512

          a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          6b4ee5bf44e795f3e895872b1751c79b

          SHA1

          d71405f09ba8923f888d5ed18ff875babade6d1e

          SHA256

          34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95

          SHA512

          a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          6b4ee5bf44e795f3e895872b1751c79b

          SHA1

          d71405f09ba8923f888d5ed18ff875babade6d1e

          SHA256

          34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95

          SHA512

          a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          6b4ee5bf44e795f3e895872b1751c79b

          SHA1

          d71405f09ba8923f888d5ed18ff875babade6d1e

          SHA256

          34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95

          SHA512

          a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

        • C:\Windows\SysWOW64\perfhost.exe

          Filesize

          1.2MB

          MD5

          6feb0f281f9262a1e1870e79949b291b

          SHA1

          febe34516421fbc61c9750698e19cc046e3b7bce

          SHA256

          2f7f98293516ef0bca03fffa96846a6e5d1206e97e8b0d0223e9a16c130cf166

          SHA512

          2bad548d52fdff68a26f9278516562884d72462b0978233b39caad38e4e7978fb7c986e0d80ceef3a3a01ace7f5be40d2c6a705e63b6819ddd02f6ffa061cb6f

        • C:\Windows\System32\Locator.exe

          Filesize

          1.2MB

          MD5

          b27a205e688b6d57eeea0829c96bb9b2

          SHA1

          0a72c163ebe7cdf898706e7160297adea5ce1774

          SHA256

          1a93ec40a2d28d6a3727a2d9b32e239622453d96e6d75bb4261b07df5f2ca977

          SHA512

          60eb8ebc23ea1a056c40cbd80c5450202c19ebad88998884c8bfeb140f4e6993f71ab05ce16b5b2ea6186907a10295fb8f9b838b8700db18dd1a9b488160da6a

        • C:\Windows\System32\SearchIndexer.exe

          Filesize

          1.1MB

          MD5

          31efce3db60fcdb8a10391b563434ae3

          SHA1

          91ff7aa5c20314e92c4719b70be8db70cbc7a7c3

          SHA256

          b0d7c30e4d1b14990074215f6f04baa292ac0ea9d4ceb1dd32dadada8ba7e1d3

          SHA512

          7b7ad060be470b4404c35e026e89e1901465bae3db94a02fa3345a5e410f4493f942a2a202bda208b1a122b4fb2c1d76a578c5303a384602b39d0cdb4cac83b7

        • C:\Windows\System32\VSSVC.exe

          Filesize

          2.1MB

          MD5

          2cf5415720bc602481a5b01864ed3749

          SHA1

          6edae9b947a11d22713c8181f7aa00c0d446fd63

          SHA256

          d348d9b441664aa2192ee601d96cec2f11280f3a3351fdc8e012a05ae7780986

          SHA512

          ede7e60130b006c00a136e3d3dac4ea3bb825448cc81285c122beb2eab85a16aca0c340d970e78724839bfa74574bdae631950401e523bb10ab566eca28c761b

        • C:\Windows\System32\alg.exe

          Filesize

          1.3MB

          MD5

          bc86840d880394add8dbd5d382819109

          SHA1

          40dc7b1d83aaa943f575ef8efbf42d8e906d94a5

          SHA256

          297b5213932a56d215e4dfd26f9e6de2fde3cf0c822b2e82ce2133b0f6f27fd4

          SHA512

          579481d08fe3175a9f58bbbe4149326de356362a716b841da1836e0735b15687fc6eedd568bc03b72215801e9eeb01352f09f858db8bc3960398b17ade6b37f2

        • C:\Windows\System32\dllhost.exe

          Filesize

          1.2MB

          MD5

          62d2af6a7267dcbf03195940327eefa0

          SHA1

          90ed6248bd95a73b3e4ea5117759de243f9ccc84

          SHA256

          8bbc0be656bb06ae9211c0fece9f403eafd33b558eb7656bd9a4f445e883ae58

          SHA512

          3b8e7aa44c8efdbd8a1310f6a119e3dce4f3f8f64eb2404cacc695ebf79d47057593098619ca35729bfdd9d7ccf4ec930f950d88747737bcbf27279b50d773a4

        • C:\Windows\System32\ieetwcollector.exe

          Filesize

          1.3MB

          MD5

          2c3a2f3e9d460757e85a6910214cf51b

          SHA1

          3ef0d033186b2ea387b48ae9053925ffc84c0d99

          SHA256

          64f592b1116faceac85b78cca0485229d6625e7e5107fb6a5f10f58124123d48

          SHA512

          60cfd5e3f49ce660a3df983651adc8952f6dddb3a79a3b9d6e9407cbcef57ad0db7ccdd19fd5a079cd2e58cf849ba61e5241bdd8f3083d884ef50cb6038b05b1

        • C:\Windows\System32\msdtc.exe

          Filesize

          1.4MB

          MD5

          5c1f7c40e3ed031def394df76c8ddfb0

          SHA1

          bbafb03de0daa551c858ffc5407eb098f36bd82d

          SHA256

          38f76f103b0bfa8a2e8e767a78de8ab3378c9d91f4d8022f16747cdda628dc36

          SHA512

          2312e5bdc0beabf927d4aeb754c8656d6d4309fb1c1a11034d86c874a31523c68a88c95137bbedc881d76094ceddf03ef542bb4d42d0c2c3f729da21d758415e

        • C:\Windows\System32\msiexec.exe

          Filesize

          1.3MB

          MD5

          b7ef069b42be911556fa0fdc4f425bce

          SHA1

          2608109532dda8cc87afd81ebb62137731c68715

          SHA256

          0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5

          SHA512

          66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

        • C:\Windows\System32\snmptrap.exe

          Filesize

          1.2MB

          MD5

          7a37e7cab456ea1a5746518401a62421

          SHA1

          3ff6a431b636bb575f6f9ba4ff9cebd73de90b84

          SHA256

          30022d08135fc937cf2cdac9f9f3e7b68242da388515d98b5f21b916b4b6ad78

          SHA512

          4cb8e71407a72aaa8dbe3f3c98dba95e9c4f2e3f0ee139d671345eb7f64622be296c67910f90e249c3d5b47953172ef78e6ca39a8e7b7b8dd1b790259ebea11e

        • C:\Windows\System32\vds.exe

          Filesize

          1.7MB

          MD5

          8678d3498696adf8705f9d20676667fd

          SHA1

          6341dfa26aa299deb4702eeb81df208ffb15aab5

          SHA256

          d13c1b2613910e084bfae2f3cca503dcbc58b232ee6deda99dccf953e3e2e46a

          SHA512

          faa8f630a615a62cacfa47a3dc4422f6a7006b36947a6889f48a659e97593a5f10e61c8e484ad0cbb1ea6a50a772bc408753f63e7e3f29344f4142ca2d560826

        • C:\Windows\System32\wbem\WmiApSrv.exe

          Filesize

          1.4MB

          MD5

          b2caaa9380afc519a92cce028415e8b1

          SHA1

          12f27ccce29a251b2e9ce53e8c0d7f5022d0c085

          SHA256

          95409632c6fd58b1861421a9d68f243edf3362e207df71ecda2b4d2ba4b7416c

          SHA512

          e30958e598b3f04aca10617ead80c0d2a3c651acf0c2d4412674acaa68d3c7995aacb2a22af9aaa33842071af14920f6df862f45c4ed6c5a647723194438bbbf

        • C:\Windows\System32\wbengine.exe

          Filesize

          2.0MB

          MD5

          3ca5409e353e9b24a1b9a8ff6bfc69e4

          SHA1

          5789c3c4ce4eda9970615bd46267d93bd4a758e2

          SHA256

          1e9cbaebb6173d1e50354de8e97d693565692535d70feb98ce80259845ba7858

          SHA512

          82889ad803c1e1f01561969869019ef6b70c1af4bd06d226bd55f799056e5184359d8cfee5be18903b32a4d56feb639d7512737476db2f1cf5a1cceb421b261f

        • C:\Windows\ehome\ehrecvr.exe

          Filesize

          1.2MB

          MD5

          1901b53af0d23c209122a68d28214803

          SHA1

          d91cecd84b4ee1ebdd85cdb107a5f36edd998836

          SHA256

          ae6cf08ed4a317d620cbc501e2ad0a9548bb4c46426d5104c1b61e67582d9c5d

          SHA512

          2f01c05c6d152b489420885919fee87f9033386d4e544a8be434c2469b0ef88de571d907e081f1052b3a28b5ca1cd6bb60e455fed8687e21de0eb7b94545b9c5

        • C:\Windows\ehome\ehsched.exe

          Filesize

          1.3MB

          MD5

          04197581c3da0794b289eb5af86b3cad

          SHA1

          768240a96c11ee998b786a3837bce29f9b286f51

          SHA256

          f6bbc636ceb4a1a3cb9550ad85be3c861cc2740d384138285848a02b1c7abac2

          SHA512

          75206ffa3c55783f92a0be2c206b1f7c8fc08c5f55e80d2cf4c5deb5ce9610d7f45959b685c327c25ee61a737ad7ef580975e4989aa3a2b5932ffc13d9040adf

        • C:\Windows\system32\msiexec.exe

          Filesize

          1.3MB

          MD5

          b7ef069b42be911556fa0fdc4f425bce

          SHA1

          2608109532dda8cc87afd81ebb62137731c68715

          SHA256

          0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5

          SHA512

          66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

        • \Program Files\Windows Media Player\wmpnetwk.exe

          Filesize

          2.0MB

          MD5

          e559b478dec21c1ae0c42e043622e1db

          SHA1

          add8d9f1af8b090addf15899ce7e9d9a64f62dfa

          SHA256

          cc71155a37b2919956edfada333c7d6ea942f0263afea632802338eb3dd01e27

          SHA512

          b5aa9d343f18dbef84b0378649c12c36737452cd1cefc3b3de582b4df162680ffa04ee548a7a9580e1315e77a98b135489ff005bef9a9ce19847d0064abc4507

        • \Program Files\Windows Media Player\wmpnetwk.exe

          Filesize

          2.0MB

          MD5

          e559b478dec21c1ae0c42e043622e1db

          SHA1

          add8d9f1af8b090addf15899ce7e9d9a64f62dfa

          SHA256

          cc71155a37b2919956edfada333c7d6ea942f0263afea632802338eb3dd01e27

          SHA512

          b5aa9d343f18dbef84b0378649c12c36737452cd1cefc3b3de582b4df162680ffa04ee548a7a9580e1315e77a98b135489ff005bef9a9ce19847d0064abc4507

        • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          0369a4f9e8adfd1f6f8e6c38b609d524

          SHA1

          f1b2a5d060d7411b90b150675dd07f490fea9f78

          SHA256

          e808eae38750114252f64dd9077cac1015d55bfd5847c8c6ad9672ca3304d5d8

          SHA512

          7e66bdb15214573be9f85af90dc111d92b7d9dd24318279282fbc5612d57fc0dc1d31c167abd7dc3ddd9c30a58879200cc3af298ec534b71d1f761a6c4dcbcef

        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

          Filesize

          1.3MB

          MD5

          53691ba15c94f286713c2e3f5622421e

          SHA1

          115d20aed6b3f9eb719919dc0416a2ee6eaa20d0

          SHA256

          d2ae4ade3fe23c490adb3943aa36fbca644ef2266b5bedaadf6151ad4fa6f6dc

          SHA512

          6735fa5b067ff667f3eb93e92a8e0d0d41149b5125800779fb817700f34b1f0708c6162b0bb57452aff243390b4130e6b23e0906675a54dc93648623b467fb32

        • \Windows\System32\Locator.exe

          Filesize

          1.2MB

          MD5

          b27a205e688b6d57eeea0829c96bb9b2

          SHA1

          0a72c163ebe7cdf898706e7160297adea5ce1774

          SHA256

          1a93ec40a2d28d6a3727a2d9b32e239622453d96e6d75bb4261b07df5f2ca977

          SHA512

          60eb8ebc23ea1a056c40cbd80c5450202c19ebad88998884c8bfeb140f4e6993f71ab05ce16b5b2ea6186907a10295fb8f9b838b8700db18dd1a9b488160da6a

        • \Windows\System32\alg.exe

          Filesize

          1.3MB

          MD5

          bc86840d880394add8dbd5d382819109

          SHA1

          40dc7b1d83aaa943f575ef8efbf42d8e906d94a5

          SHA256

          297b5213932a56d215e4dfd26f9e6de2fde3cf0c822b2e82ce2133b0f6f27fd4

          SHA512

          579481d08fe3175a9f58bbbe4149326de356362a716b841da1836e0735b15687fc6eedd568bc03b72215801e9eeb01352f09f858db8bc3960398b17ade6b37f2

        • \Windows\System32\dllhost.exe

          Filesize

          1.2MB

          MD5

          62d2af6a7267dcbf03195940327eefa0

          SHA1

          90ed6248bd95a73b3e4ea5117759de243f9ccc84

          SHA256

          8bbc0be656bb06ae9211c0fece9f403eafd33b558eb7656bd9a4f445e883ae58

          SHA512

          3b8e7aa44c8efdbd8a1310f6a119e3dce4f3f8f64eb2404cacc695ebf79d47057593098619ca35729bfdd9d7ccf4ec930f950d88747737bcbf27279b50d773a4

        • \Windows\System32\ieetwcollector.exe

          Filesize

          1.3MB

          MD5

          2c3a2f3e9d460757e85a6910214cf51b

          SHA1

          3ef0d033186b2ea387b48ae9053925ffc84c0d99

          SHA256

          64f592b1116faceac85b78cca0485229d6625e7e5107fb6a5f10f58124123d48

          SHA512

          60cfd5e3f49ce660a3df983651adc8952f6dddb3a79a3b9d6e9407cbcef57ad0db7ccdd19fd5a079cd2e58cf849ba61e5241bdd8f3083d884ef50cb6038b05b1

        • \Windows\System32\msdtc.exe

          Filesize

          1.4MB

          MD5

          5c1f7c40e3ed031def394df76c8ddfb0

          SHA1

          bbafb03de0daa551c858ffc5407eb098f36bd82d

          SHA256

          38f76f103b0bfa8a2e8e767a78de8ab3378c9d91f4d8022f16747cdda628dc36

          SHA512

          2312e5bdc0beabf927d4aeb754c8656d6d4309fb1c1a11034d86c874a31523c68a88c95137bbedc881d76094ceddf03ef542bb4d42d0c2c3f729da21d758415e

        • \Windows\System32\msiexec.exe

          Filesize

          1.3MB

          MD5

          b7ef069b42be911556fa0fdc4f425bce

          SHA1

          2608109532dda8cc87afd81ebb62137731c68715

          SHA256

          0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5

          SHA512

          66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

        • \Windows\System32\msiexec.exe

          Filesize

          1.3MB

          MD5

          b7ef069b42be911556fa0fdc4f425bce

          SHA1

          2608109532dda8cc87afd81ebb62137731c68715

          SHA256

          0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5

          SHA512

          66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

        • \Windows\System32\snmptrap.exe

          Filesize

          1.2MB

          MD5

          7a37e7cab456ea1a5746518401a62421

          SHA1

          3ff6a431b636bb575f6f9ba4ff9cebd73de90b84

          SHA256

          30022d08135fc937cf2cdac9f9f3e7b68242da388515d98b5f21b916b4b6ad78

          SHA512

          4cb8e71407a72aaa8dbe3f3c98dba95e9c4f2e3f0ee139d671345eb7f64622be296c67910f90e249c3d5b47953172ef78e6ca39a8e7b7b8dd1b790259ebea11e

        • \Windows\System32\vds.exe

          Filesize

          1.7MB

          MD5

          8678d3498696adf8705f9d20676667fd

          SHA1

          6341dfa26aa299deb4702eeb81df208ffb15aab5

          SHA256

          d13c1b2613910e084bfae2f3cca503dcbc58b232ee6deda99dccf953e3e2e46a

          SHA512

          faa8f630a615a62cacfa47a3dc4422f6a7006b36947a6889f48a659e97593a5f10e61c8e484ad0cbb1ea6a50a772bc408753f63e7e3f29344f4142ca2d560826

        • \Windows\System32\wbem\WmiApSrv.exe

          Filesize

          1.4MB

          MD5

          b2caaa9380afc519a92cce028415e8b1

          SHA1

          12f27ccce29a251b2e9ce53e8c0d7f5022d0c085

          SHA256

          95409632c6fd58b1861421a9d68f243edf3362e207df71ecda2b4d2ba4b7416c

          SHA512

          e30958e598b3f04aca10617ead80c0d2a3c651acf0c2d4412674acaa68d3c7995aacb2a22af9aaa33842071af14920f6df862f45c4ed6c5a647723194438bbbf

        • \Windows\System32\wbengine.exe

          Filesize

          2.0MB

          MD5

          3ca5409e353e9b24a1b9a8ff6bfc69e4

          SHA1

          5789c3c4ce4eda9970615bd46267d93bd4a758e2

          SHA256

          1e9cbaebb6173d1e50354de8e97d693565692535d70feb98ce80259845ba7858

          SHA512

          82889ad803c1e1f01561969869019ef6b70c1af4bd06d226bd55f799056e5184359d8cfee5be18903b32a4d56feb639d7512737476db2f1cf5a1cceb421b261f

        • \Windows\ehome\ehrecvr.exe

          Filesize

          1.2MB

          MD5

          1901b53af0d23c209122a68d28214803

          SHA1

          d91cecd84b4ee1ebdd85cdb107a5f36edd998836

          SHA256

          ae6cf08ed4a317d620cbc501e2ad0a9548bb4c46426d5104c1b61e67582d9c5d

          SHA512

          2f01c05c6d152b489420885919fee87f9033386d4e544a8be434c2469b0ef88de571d907e081f1052b3a28b5ca1cd6bb60e455fed8687e21de0eb7b94545b9c5

        • \Windows\ehome\ehsched.exe

          Filesize

          1.3MB

          MD5

          04197581c3da0794b289eb5af86b3cad

          SHA1

          768240a96c11ee998b786a3837bce29f9b286f51

          SHA256

          f6bbc636ceb4a1a3cb9550ad85be3c861cc2740d384138285848a02b1c7abac2

          SHA512

          75206ffa3c55783f92a0be2c206b1f7c8fc08c5f55e80d2cf4c5deb5ce9610d7f45959b685c327c25ee61a737ad7ef580975e4989aa3a2b5932ffc13d9040adf

        • memory/820-101-0x0000000140000000-0x00000001401F4000-memory.dmp

          Filesize

          2.0MB

        • memory/920-211-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/920-67-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/920-79-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/920-73-0x0000000000100000-0x0000000000166000-memory.dmp

          Filesize

          408KB

        • memory/920-61-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/920-60-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/920-62-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/920-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/920-68-0x0000000000100000-0x0000000000166000-memory.dmp

          Filesize

          408KB

        • memory/920-65-0x0000000000400000-0x000000000065B000-memory.dmp

          Filesize

          2.4MB

        • memory/968-104-0x0000000010000000-0x00000000101F6000-memory.dmp

          Filesize

          2.0MB

        • memory/1396-156-0x0000000001380000-0x0000000001390000-memory.dmp

          Filesize

          64KB

        • memory/1396-289-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/1396-158-0x0000000001390000-0x00000000013A0000-memory.dmp

          Filesize

          64KB

        • memory/1396-152-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/1396-611-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/1396-147-0x0000000000880000-0x00000000008E0000-memory.dmp

          Filesize

          384KB

        • memory/1396-141-0x0000000000880000-0x00000000008E0000-memory.dmp

          Filesize

          384KB

        • memory/1396-183-0x0000000001430000-0x0000000001431000-memory.dmp

          Filesize

          4KB

        • memory/1432-128-0x0000000010000000-0x00000000101FE000-memory.dmp

          Filesize

          2.0MB

        • memory/1460-149-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/1552-514-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/1552-213-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/1680-150-0x0000000100000000-0x00000001001EC000-memory.dmp

          Filesize

          1.9MB

        • memory/1712-497-0x000000002E000000-0x000000002FE1E000-memory.dmp

          Filesize

          30.1MB

        • memory/1712-218-0x000000002E000000-0x000000002FE1E000-memory.dmp

          Filesize

          30.1MB

        • memory/1716-57-0x00000000002F0000-0x00000000002FC000-memory.dmp

          Filesize

          48KB

        • memory/1716-58-0x000000000A990000-0x000000000AACC000-memory.dmp

          Filesize

          1.2MB

        • memory/1716-56-0x00000000002C0000-0x00000000002D6000-memory.dmp

          Filesize

          88KB

        • memory/1716-59-0x000000000DAD0000-0x000000000DC88000-memory.dmp

          Filesize

          1.7MB

        • memory/1716-55-0x0000000001310000-0x0000000001350000-memory.dmp

          Filesize

          256KB

        • memory/1716-54-0x00000000013B0000-0x000000000152C000-memory.dmp

          Filesize

          1.5MB

        • memory/1732-173-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/1732-496-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/1732-187-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/1732-189-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/1812-320-0x0000000000B30000-0x0000000000BB0000-memory.dmp

          Filesize

          512KB

        • memory/1812-214-0x0000000000B30000-0x0000000000BB0000-memory.dmp

          Filesize

          512KB

        • memory/1848-100-0x0000000100000000-0x00000001001FB000-memory.dmp

          Filesize

          2.0MB

        • memory/1848-88-0x00000000008B0000-0x0000000000910000-memory.dmp

          Filesize

          384KB

        • memory/1848-82-0x00000000008B0000-0x0000000000910000-memory.dmp

          Filesize

          384KB

        • memory/1964-118-0x0000000000C30000-0x0000000000C96000-memory.dmp

          Filesize

          408KB

        • memory/1964-113-0x0000000000C30000-0x0000000000C96000-memory.dmp

          Filesize

          408KB

        • memory/1964-130-0x0000000000400000-0x00000000005FF000-memory.dmp

          Filesize

          2.0MB

        • memory/1992-606-0x0000000000400000-0x00000000005FF000-memory.dmp

          Filesize

          2.0MB

        • memory/2008-546-0x0000000140000000-0x0000000140209000-memory.dmp

          Filesize

          2.0MB

        • memory/2008-164-0x0000000000850000-0x00000000008B0000-memory.dmp

          Filesize

          384KB

        • memory/2008-155-0x0000000000850000-0x00000000008B0000-memory.dmp

          Filesize

          384KB

        • memory/2008-312-0x0000000140000000-0x0000000140209000-memory.dmp

          Filesize

          2.0MB

        • memory/2008-157-0x0000000140000000-0x0000000140209000-memory.dmp

          Filesize

          2.0MB

        • memory/2012-185-0x00000000001F0000-0x0000000000250000-memory.dmp

          Filesize

          384KB

        • memory/2012-255-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/2012-171-0x00000000001F0000-0x0000000000250000-memory.dmp

          Filesize

          384KB

        • memory/2012-186-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/2096-251-0x0000000140000000-0x0000000140221000-memory.dmp

          Filesize

          2.1MB

        • memory/2120-362-0x0000000100000000-0x0000000100202000-memory.dmp

          Filesize

          2.0MB

        • memory/2120-513-0x0000000100000000-0x0000000100202000-memory.dmp

          Filesize

          2.0MB

        • memory/2152-257-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/2152-500-0x0000000140000000-0x0000000140205000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-386-0x0000000100000000-0x000000010021B000-memory.dmp

          Filesize

          2.1MB

        • memory/2168-542-0x0000000100000000-0x000000010021B000-memory.dmp

          Filesize

          2.1MB

        • memory/2212-258-0x0000000140000000-0x000000014020D000-memory.dmp

          Filesize

          2.1MB

        • memory/2368-273-0x00000000006E0000-0x00000000008E9000-memory.dmp

          Filesize

          2.0MB

        • memory/2368-256-0x0000000100000000-0x0000000100209000-memory.dmp

          Filesize

          2.0MB

        • memory/2368-501-0x00000000006E0000-0x00000000008E9000-memory.dmp

          Filesize

          2.0MB

        • memory/2368-499-0x0000000100000000-0x0000000100209000-memory.dmp

          Filesize

          2.0MB

        • memory/2500-543-0x0000000100000000-0x000000010020A000-memory.dmp

          Filesize

          2.0MB

        • memory/2500-388-0x0000000100000000-0x000000010020A000-memory.dmp

          Filesize

          2.0MB

        • memory/2548-290-0x000000002E000000-0x000000002E20C000-memory.dmp

          Filesize

          2.0MB

        • memory/2584-502-0x0000000100000000-0x0000000100542000-memory.dmp

          Filesize

          5.3MB

        • memory/2584-292-0x0000000100000000-0x0000000100542000-memory.dmp

          Filesize

          5.3MB

        • memory/2652-424-0x0000000100000000-0x0000000100123000-memory.dmp

          Filesize

          1.1MB

        • memory/2680-315-0x0000000001000000-0x00000000011ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2708-318-0x0000000100000000-0x00000001001EC000-memory.dmp

          Filesize

          1.9MB

        • memory/2800-503-0x0000000100000000-0x00000001001ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2800-321-0x0000000100000000-0x00000001001ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2908-508-0x0000000100000000-0x000000010026B000-memory.dmp

          Filesize

          2.4MB

        • memory/2908-356-0x0000000100000000-0x000000010026B000-memory.dmp

          Filesize

          2.4MB

        • memory/2984-509-0x0000000100000000-0x0000000100219000-memory.dmp

          Filesize

          2.1MB

        • memory/2984-358-0x0000000100000000-0x0000000100219000-memory.dmp

          Filesize

          2.1MB

        • memory/3004-541-0x0000000000400000-0x00000000005FF000-memory.dmp

          Filesize

          2.0MB

        • memory/3016-510-0x0000000000400000-0x00000000005FF000-memory.dmp

          Filesize

          2.0MB

        • memory/3016-360-0x0000000000400000-0x00000000005FF000-memory.dmp

          Filesize

          2.0MB

        • memory/3016-558-0x0000000000400000-0x00000000005FF000-memory.dmp

          Filesize

          2.0MB