Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

8dcc9696b4...d2.exe

windows7-x64

7

8dcc9696b4...d2.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 19:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe

  • Size

    1.8MB

  • MD5

    106b10b10937eb57d248fa830b6b8b61

  • SHA1

    74018a5f3e9c5c5109ed7c253860a6750cfed3e9

  • SHA256

    8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2

  • SHA512

    28b80206950cd66cb6e05623a88b3d7d6ef8531c76a2e3e077cbe8527ca97dad24509d3f235ea89217e4a51d9f3402d9e61bd31ce65f2a7e4c9b0fdf0eb94c66

  • SSDEEP

    49152:BM9QPdxwfE7WlFwKAfzuTiDFUFknLTM7rr62MboH7:B1PdVQFwKZCFgiTM/22Es

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 61 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 60 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
    "C:\Users\Admin\AppData\Local\Temp\8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2940
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2100
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2948
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2776
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1536
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1972
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2564
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 250 -NGENProcess 254 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1ec -NGENProcess 258 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 260 -NGENProcess 25c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 248 -NGENProcess 240 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 268 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1588
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2248
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 25c -NGENProcess 260 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1304
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 25c -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1388
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 278 -NGENProcess 280 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1516
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 250 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 240 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 278 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1956
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 280 -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 280 -NGENProcess 25c -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1140
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 280 -NGENProcess 26c -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 298 -NGENProcess 2a0 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1304
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 25c -NGENProcess 2a4 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 278 -NGENProcess 2a0 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2424
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 288 -NGENProcess 2ac -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 288 -NGENProcess 254 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2d0 -NGENProcess 2ac -Pipe 2cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2d0 -NGENProcess 288 -Pipe 2c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2204
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 26c -NGENProcess 2dc -Pipe 2d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2ac -NGENProcess 2e0 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e0 -NGENProcess 2dc -Pipe 2d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2e0 -NGENProcess 2e4 -Pipe 2c4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2448
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 254 -NGENProcess 260 -Pipe 21c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2888
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1212
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1140
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2508
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    PID:1740
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:2256
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:896
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1700
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1388
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2992
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2708
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2520
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2672
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:1064
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2480
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:792
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:1616
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:2080
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:920
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:904
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2044
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2096
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:1608
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2620
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3513876443-2771975297-1923446376-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3513876443-2771975297-1923446376-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:900
    • C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
      2⤵
      • Modifies data under HKEY_USERS
      PID:1392
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
    Filesize

    1.3MB

    MD5

    60f214a507dc18cbee1f9eaa247727c8

    SHA1

    45d0e5ae182dad3c7e067f68cc27912e1ddcc335

    SHA256

    bed91a79245865d03133ed4168a5faa70ca90b86b523702c7526774f935d8367

    SHA512

    343334c5edff63db47df4b430bf2758c71f6956e879ad11a87d9ba81c74a97697de3f182c1c9eb8a320183d82d068c66c2e3c7b98b8860620850fa0c791247c0

    Download Submit

  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    Filesize

    30.1MB

    MD5

    63351fa6e0728463f2801b4dd3fe1c25

    SHA1

    c884c2a827915f8656d4532b97912676897496f0

    SHA256

    8cfed3f6f415f6b50315a2d5a1cab95a32cc2c4249cb0e4acd1811b4bb346730

    SHA512

    bc4aa1cf0d5fe18c9a70e255591a81ea434d3832bef34ef21584811acf3f093edac4c1e049986346b69c6ada97a5902cdcb1261e743f397065ef59453c06d52b

    Download Submit

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    Filesize

    1.4MB

    MD5

    335aaa8c95691fc521bca5bfbc1cf633

    SHA1

    ed947a1fb052515ec265893b0bb0579407c1e544

    SHA256

    36e3ccb86c1fb4cb249547c3f10ce7581a4b708d6f2acd7fc77055b6f6ef1fdd

    SHA512

    806ec10533aad6dc6d15a8a9f82916fbd7c4448bb546a1fef93ab73d6486dcdfdb9a6d38ba15b83cca43fbc5cac5cbe30a54e009691da8a2cd474e14061e256a

    Download Submit

  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    Filesize

    5.2MB

    MD5

    24fd31690151c3a7650adb573e61d3de

    SHA1

    9fa3fcaa571848d7d7b8bc9f53976dde91223beb

    SHA256

    e2e2e30c56e275abd6de5cd4c9f2541588c377a7384ed22de683847c11b9b414

    SHA512

    978c2a38a955cf9f00e9117d4252cfafee5230b58f550598773f68ae252a2b8d2ad5b7e4a2462216e7d486faaf126823f8b1e77ca9efa7e8464fda4ac012dbd2

    Download Submit

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    Filesize

    2.1MB

    MD5

    07a0b74f931702c49f5d00fdaf6bca4c

    SHA1

    a7eaddf57dec633aafcb31742c779aa13c7f4c8f

    SHA256

    d1f326e866b7e52c8962717e00ae2d2feedba9b3d6b45f52de26e2501cbd8584

    SHA512

    ceff5a38f7d4a9ac493e57fd17a764b9fedd043510dde5c0c7035b5c9adb178459a3ffe8004cd377f5ae58aed6031d9251f9b83cffc2c63f89c9055a9304ef8d

    Download Submit

  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    Filesize

    2.0MB

    MD5

    f70c61e6eec326dd5286415b53e46c60

    SHA1

    9f4788ba559c9293b334c74c2edf52961d1df366

    SHA256

    2e123f090872fabf163b98722e00c003911c3dcb5692f8df6681181eae3f2065

    SHA512

    6b76768ddff274d53f9717270486bf8b659e80ed6aee1a6c4a90b2aa3e2e11a6a65ebdee94c96d85e90a50fa1a1d217c6298601a83a9e9281304c8e5b9ce1939

    Download Submit

  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
    Filesize

    1024KB

    MD5

    bdfab8d50e977c80a0d50a6ab5963188

    SHA1

    721336367cf334ae38039d0898a794b71690c366

    SHA256

    1000a4f102d9a11eaf52791eda9e000716624063398772a94e99029cd1c084ef

    SHA512

    b71e8fdbc799822072753d8693b19ce30df339b008811e48ac3024319a74f7665cf1e9a818cbc50a446a1fc4e44c31d23064118b206a8bf8fe3e6ec3e58a2043

    Download Submit

  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.000
    Filesize

    240B

    MD5

    7ca2da6f1e7bca562d7d9376700a912f

    SHA1

    67feaa004013eee76282e3b3fc196279f2577dcb

    SHA256

    04fd7654331261ff9ec331c31b238ba7770f082abfb817d7881813ec02084a4e

    SHA512

    4f2f67dee86af03dae15145649f5eb65cd158686381d26005b91aab89f017b692289050f0b1def00f8c2e724aedba4025db0baa6b55f76d402ded8006c48b38d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
    Filesize

    24B

    MD5

    b9bd716de6739e51c620f2086f9c31e4

    SHA1

    9733d94607a3cba277e567af584510edd9febf62

    SHA256

    7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

    SHA512

    cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    7ce6eb49ff4fc6ef3e0377350007716b

    SHA1

    7b9df8411f4fdcf70f135acbbc9eb34134a1daa9

    SHA256

    a8f27059b43089c37bc291c9dc48031e473901dc3389140767e54cebaec377f2

    SHA512

    d3f97212bfd15d36a46b05258c109cf9e59764ece283766253da276f86f6ac59cf6910f54cdb66c58b231146445543ce46c6923d86138dbfcf9336fd52352c97

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    7ce6eb49ff4fc6ef3e0377350007716b

    SHA1

    7b9df8411f4fdcf70f135acbbc9eb34134a1daa9

    SHA256

    a8f27059b43089c37bc291c9dc48031e473901dc3389140767e54cebaec377f2

    SHA512

    d3f97212bfd15d36a46b05258c109cf9e59764ece283766253da276f86f6ac59cf6910f54cdb66c58b231146445543ce46c6923d86138dbfcf9336fd52352c97

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
    Filesize

    872KB

    MD5

    8c7c2804e977cec250bdd7b8c93f6555

    SHA1

    29373c9560cd713bd12255ce431672e6b1c75b51

    SHA256

    303139a2f1472f9f8d746409d3d819d499a6502e8c8751ddf045986953ce4dfa

    SHA512

    9b9686c99933295e29c4216c1e946aace00576c7747cd28a76fb5d5034e3eb0bac84a09bca583191a165c1e0c8e9207919bfe40dff37c8112fc41d778aa059c3

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    Filesize

    1.2MB

    MD5

    7ee5fc1641639ae18598d98cfbc44793

    SHA1

    d9822e9e47fb91fd211bf478fa5ed3d65b6620d3

    SHA256

    ba4a667582f16bb5d14dce1a421c6873706e39bc5d2a3d50cac36e5ded4b1304

    SHA512

    b5b3310fa1fa3ee0bb67018bdf11195ebda0c40ecf35c3c5d882e24e3bb4db807c1c8b44585ee84ddccda7e28d46512591a03aabefdad51ad544d453aae864dc

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    4706ad13a3e60f92b075c97acecf3da5

    SHA1

    d6acfe097eca534f8a40fc2fae5cae22f9af843d

    SHA256

    66457493f8fea9af7fd5bb81bd5f800bd844ca29ffca46de5a586dd3601a1fae

    SHA512

    2730d5d43c6d98d5becf3bdf6e195d648f0d17f4561fcc1129912367d8c41c479ad4333aa17da75f4f3794ec4aa15a3660acbe49ccd802c1cd87057c9cd7e586

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    4706ad13a3e60f92b075c97acecf3da5

    SHA1

    d6acfe097eca534f8a40fc2fae5cae22f9af843d

    SHA256

    66457493f8fea9af7fd5bb81bd5f800bd844ca29ffca46de5a586dd3601a1fae

    SHA512

    2730d5d43c6d98d5becf3bdf6e195d648f0d17f4561fcc1129912367d8c41c479ad4333aa17da75f4f3794ec4aa15a3660acbe49ccd802c1cd87057c9cd7e586

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    Filesize

    1.2MB

    MD5

    477a20c9ca01b86c5546143a5974618f

    SHA1

    710f59e712a0f207eb00d911bfed7f6357b9191c

    SHA256

    ec81339c9c3016c6e8757a739529bc8bd8950a776e96d0019a276bca004a3c11

    SHA512

    8b5bdfe822a0302b859f2f0a2507ee30c9e9f43d175f58a1013e5b279ebbdfaf117c008943dd8c94867f9b1e85e5e99b744cebd35d808b14e741e100e131e781

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    Filesize

    1.2MB

    MD5

    477a20c9ca01b86c5546143a5974618f

    SHA1

    710f59e712a0f207eb00d911bfed7f6357b9191c

    SHA256

    ec81339c9c3016c6e8757a739529bc8bd8950a776e96d0019a276bca004a3c11

    SHA512

    8b5bdfe822a0302b859f2f0a2507ee30c9e9f43d175f58a1013e5b279ebbdfaf117c008943dd8c94867f9b1e85e5e99b744cebd35d808b14e741e100e131e781

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
    Filesize

    1003KB

    MD5

    6287f4090b0af59a678cbf123eb2473a

    SHA1

    1689debc4af40e2705834b7c19966796242ef5b4

    SHA256

    045a33284bcb5bb67c3f6f2d8c5d397c94f5306aff21d3ef7608596e5ce7f949

    SHA512

    932552a888a3bd0ea9ba3e182fcd47afbf613c677fece981e42ef6f8444cd1a749804cf18ac12cec32ea2f476a3b6a6b922e311312e8bd60ffb40ed163886041

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    ef9736ad7bdd3c19744020ea753edce8

    SHA1

    b5a92f95cc4e02ff619821651ed8d9dec267e862

    SHA256

    f94668e88b2cb84a14f6c22e28a813b7d54eb600d3495729e69ae16c3fe6e6a9

    SHA512

    084df07e11aab73d5a91457ea69402ef8ced656dc25ded7ded82a7ac89dfacb88f6d57341525578cb04507af2cdf02f91eb7fcd446d96b1342f364b0020f3d06

    Download Submit

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
    Filesize

    8KB

    MD5

    3304551bf919831acc9d9a49c6d52483

    SHA1

    3e0d6d328be979ecaf27cc7f303bcf381dd2653e

    SHA256

    b29b6765397b3a13583185a3ce4a0afce39f7cc33e44b1d188c5d062b036db54

    SHA512

    acf0a3f82d9736c5835043743caa20e878a06a7358bf1aa51bb00c036ccc82c84a0dd6e79ad80ddb722d2bb0d1a2b767593066e8d9dd8e39d9dcf8448906a978

    Download Submit

  • C:\Windows\SysWOW64\perfhost.exe
    Filesize

    1.2MB

    MD5

    bc60a5f31c118da5d37f79be1cbe7a63

    SHA1

    7c60b9215388fa32a28516e3f8a3accc4965691f

    SHA256

    9ece4326e76a3ed582b91c6199bec26b83ebbeabf001d35c8224a39c22f4b887

    SHA512

    8e8d2171394a78c53e9bd0bc9bc1524f9eafa1407fec68e5c7eb6c794463e5ae73c460b6085cd185e1b950d53f10ad9393c4012e91cc2e373b2faace55a0174d

    Download Submit

  • C:\Windows\System32\Locator.exe
    Filesize

    1.2MB

    MD5

    ba6f8078da13e01eaffc64ad9a30dbde

    SHA1

    baec2532da1583360542ea48934b629fe80f99e6

    SHA256

    851634de6bcaeec404bd378135f97f92159c11fcad86f0d7512cd94657bb4cca

    SHA512

    2cff8e9221c73f4a8935ad5f152cebfbbb07acfbbb9e0fa5360b27990f45b72a1ea47518c374538484c7c8fccd1d84e184099bd79f1f1a453188ea23e0bb1b30

    Download Submit

  • C:\Windows\System32\SearchIndexer.exe
    Filesize

    1.1MB

    MD5

    a54e4421a59f60cac4b6c790c074692a

    SHA1

    4456ca01816f6e3e8b7abb7998120623ae3b868d

    SHA256

    90e4289df357c94c8aa2652ece985351da66ffe5a0cf6499100cdbffa828dbf7

    SHA512

    655a4903498e80be39f1e856a406c76b6553b6399f0557d712f615593209e934d95f870f4be9d0f9003271065a7c0ea9757f4919e605f6a08c1f392a3547a00c

    Download Submit

  • C:\Windows\System32\VSSVC.exe
    Filesize

    2.1MB

    MD5

    8c87b419ca583634455965d2c99ca744

    SHA1

    18c13ff8059ab3392c3d13d64a5289a48162d473

    SHA256

    ffcbb1df853ceb16ac24ee484da630d1aacd1b1b679c678c3c4d7bba42a766e7

    SHA512

    9a0708bd4cb6865604ab81bfb126b78e4ae11dead75ee8e62595bb820aba971c9ce4f119edd07bc8d943a101e06f6d7d899c93ac026c9cce97cb59b1e9e23c6b

    Download Submit

  • C:\Windows\System32\alg.exe
    Filesize

    1.3MB

    MD5

    9cd343bc83279b5425e5d8b2c1531925

    SHA1

    8dda3d81b9a92b2ef3f6a7299ae5b6dbcc1f49f0

    SHA256

    ca1a908a06e63513cb911331e682444ccd8cbd31512337566722b0bf58163355

    SHA512

    7443f671346b543d64b3d2c15a9880b6b79a6b21cf2d877fd3f1f3073cef6cc9a48f2d89d492772b384d47722ebe3406bb27d96bdab8008570a8402a5aebc5b1

    Download Submit

  • C:\Windows\System32\dllhost.exe
    Filesize

    1.2MB

    MD5

    f0b1c876bfb010b34bdd09a9288d83e9

    SHA1

    41da03498f61d0b93c96bff87ab31436736e725a

    SHA256

    0862a6c4b7678e142c8923e56c1b97f0f4644874988c20ba83c011e4b6bb836b

    SHA512

    cf8c348a8cb5682e7df5cc8386ca3dbfd55f810072c9afa7f6bcdd737a6d0f357d26057d6f99df2536683332d0510905e535bae3e0932f340f14372cf8512c7f

    Download Submit

  • C:\Windows\System32\msdtc.exe
    Filesize

    1.3MB

    MD5

    eb8c8da56f0d27064ae4cab2fe7444ae

    SHA1

    ceb25ce857b7f4f8a84b55ee420d1126bdfeecb6

    SHA256

    72fbf72a7be720006577020391fa0d578fe9f3232889b670a555c44c645a8da0

    SHA512

    035134ab39f20f960ff105fb99e164ec8e40c4a60347cebbe815cbaf383fb94b6ff7fa402a2a5a39ba6e1c92ff377bdb51d23e8c8b66acbf8f66fdadf4b1aa40

    Download Submit

  • C:\Windows\System32\msiexec.exe
    Filesize

    1.3MB

    MD5

    a879edf31db938c0cf063fee11c41e66

    SHA1

    f2d76a2a56f255b94088156297cc9eb6cfe5fe79

    SHA256

    1fb5706e5e197057cb09d3ddc7bb8634c673e7feb3e40b6b94a1b7ef5b978c1c

    SHA512

    3321503dcbbdd41d749907868642b4481f81e4ed10a65f356175aa9c2f62432fc76bb11738be29d71ce1beb5b6cacde7cd40b999f6db43b0dbdce3c80c496c95

    Download Submit

  • C:\Windows\System32\snmptrap.exe
    Filesize

    1.2MB

    MD5

    cbb34afb1b64e164b4d192e301488aae

    SHA1

    8b4630cc819147f4be0bf8f5d291cbc15d45209b

    SHA256

    ab33daf4823b277431cfdca6750d1829468b6030947cbdd8aef72132861258e6

    SHA512

    df18dfa317e91198cd4570f9cd030120d69679232959bf8933c6449a285c02a73f0fb7bfdc5ec91ebd96b5362c784351c679ae90d669abd30875a9f1de42c77a

    Download Submit

  • C:\Windows\System32\vds.exe
    Filesize

    1.7MB

    MD5

    a7af520111d4564013eea4430d5762df

    SHA1

    04ae2ea0d3d3164ef8d377ca20f32d2b8cff0c7e

    SHA256

    284d6cf9753cafd512feef59f31e0c7f1f8b16ea58fb273542e40872ae2ce09e

    SHA512

    d4acd3ae8dfb4c5f3d496793e1166b150973209c3c5b5c0c745dd5f96668080da9fd849e55503ee1fcdf03f4e7303b95c257353efffe771ffcbde8d972adac36

    Download Submit

  • C:\Windows\System32\wbem\WmiApSrv.exe
    Filesize

    1.4MB

    MD5

    909260fc02114d3bf60bb76a4bb004e1

    SHA1

    c87552a2f6dc826d0f1eb719579c08753c2f0b3a

    SHA256

    41e139880e841c20385230a5a6a0c0e57117a847f12e9d6e48a228b677f29e2d

    SHA512

    d03737ee4d3cb97741a6c3c1415414446f9ec701ab61c633b63b3a13ade3736278d72d5c23f4fe9f1881000bd0f1c9efe60bfbefb51f49abec40d961c5263d52

    Download Submit

  • C:\Windows\System32\wbengine.exe
    Filesize

    2.0MB

    MD5

    f00a4c8cacd8e4b36235a90dbe18ba98

    SHA1

    3605bb2a65cbdf1c9425bb48a8ad5c806d631365

    SHA256

    6306dbfb07746105445e4232a6e1f7665cb9699711db5c4d4cdbb0de42f29db8

    SHA512

    be43b08d19bc3516e542f901a3f9d00c12fdfbb428f1e94126069801d3f56b6dd9525b61ea2e42a72639c5bca02e0c6d4233d158c5df8f88ae11749d7c170234

    Download Submit

  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
    Filesize

    210KB

    MD5

    4f40997b51420653706cb0958086cd2d

    SHA1

    0069b956d17ce7d782a0e054995317f2f621b502

    SHA256

    8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

    SHA512

    e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

    Download Submit

  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
    Filesize

    59KB

    MD5

    8c69bbdfbc8cc3fa3fa5edcd79901e94

    SHA1

    b8028f0f557692221d5c0160ec6ce414b2bdf19b

    SHA256

    a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

    SHA512

    825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

    Download Submit

  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
    Filesize

    42KB

    MD5

    71d4273e5b77cf01239a5d4f29e064fc

    SHA1

    e8876dea4e4c4c099e27234742016be3c80d8b62

    SHA256

    f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

    SHA512

    41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

    Download Submit

  • C:\Windows\ehome\ehrecvr.exe
    Filesize

    1.2MB

    MD5

    45a9e87fb1b0db3e19a6dffbe32d86a9

    SHA1

    b7231016aa2b1d433ad366bd67d0b1775268c2bb

    SHA256

    2ebb92abd14df025a7411d922de39e3bd3c496bbdc22e43eb8b272c89f6d1d60

    SHA512

    9232e53c65748dac558c8db6c57f1a41d8b68acad1e9cbb511e7950f538e6d33aaa00d941346f604972d37bf8b4ea7bae5541ec27a518a6097a803ba7aa1cc68

    Download Submit

  • C:\Windows\ehome\ehsched.exe
    Filesize

    1.3MB

    MD5

    1fd0d33431ea07b29962538b4e8cfbf4

    SHA1

    3bebc11035ff55fd64e792ea0ada409ec76295a1

    SHA256

    0687d95adad84bf04c01938dc91283fdd499bb9e7af55477b22b03eb8610ed54

    SHA512

    efc401d0c8aeadb2e03cbba3dcc0eda9f3dc827dee3e9d84c0ea2d8001154508678ad87ee78e2ac4235a11dcacc1e6ff2b646b113b3bbdbcf2f9c868dcde3fa5

    Download Submit

  • C:\Windows\system32\IEEtwCollector.exe
    Filesize

    1.3MB

    MD5

    2667b12c6b78f312e495103bb87e4094

    SHA1

    337b115a9441e751879efb2c3eeb3a7eaf66d284

    SHA256

    63530aab553e6ddec2671706cf4de14884cde0699f0a19f545859430775f8b74

    SHA512

    134732df865e07723c44a6f904317dfad44497c708dbbf735bc7dff75b9b70b90b1d1b1e7f9498d58c48ff0ee2eb5344983759c6db1bab36d5cf05c40ae80f40

    Download Submit

  • C:\Windows\system32\fxssvc.exe
    Filesize

    1.2MB

    MD5

    b37eb4a7545a7188de22d60e196d6ffb

    SHA1

    06691ade8320d13c2276a897f1984aaf047d4a9c

    SHA256

    08b9bd4087c56e8cad2f3f4b82525f2c02185809d52b31d038883c6a87399b04

    SHA512

    6e143dabf2dfaa1d3bf89e05a1c57203b978e2ae3ccc78cd22e479b3ccbfb042fcbf3f7b2d8aa5befe4530c70ccd3a3e588c647c99a24a7f55f7aec9aa6966a3

    Download Submit

  • C:\Windows\system32\msiexec.exe
    Filesize

    1.3MB

    MD5

    a879edf31db938c0cf063fee11c41e66

    SHA1

    f2d76a2a56f255b94088156297cc9eb6cfe5fe79

    SHA256

    1fb5706e5e197057cb09d3ddc7bb8634c673e7feb3e40b6b94a1b7ef5b978c1c

    SHA512

    3321503dcbbdd41d749907868642b4481f81e4ed10a65f356175aa9c2f62432fc76bb11738be29d71ce1beb5b6cacde7cd40b999f6db43b0dbdce3c80c496c95

    Download Submit

  • \Program Files\Windows Media Player\wmpnetwk.exe
    Filesize

    2.0MB

    MD5

    f70c61e6eec326dd5286415b53e46c60

    SHA1

    9f4788ba559c9293b334c74c2edf52961d1df366

    SHA256

    2e123f090872fabf163b98722e00c003911c3dcb5692f8df6681181eae3f2065

    SHA512

    6b76768ddff274d53f9717270486bf8b659e80ed6aee1a6c4a90b2aa3e2e11a6a65ebdee94c96d85e90a50fa1a1d217c6298601a83a9e9281304c8e5b9ce1939

    Download Submit

  • \Program Files\Windows Media Player\wmpnetwk.exe
    Filesize

    2.0MB

    MD5

    f70c61e6eec326dd5286415b53e46c60

    SHA1

    9f4788ba559c9293b334c74c2edf52961d1df366

    SHA256

    2e123f090872fabf163b98722e00c003911c3dcb5692f8df6681181eae3f2065

    SHA512

    6b76768ddff274d53f9717270486bf8b659e80ed6aee1a6c4a90b2aa3e2e11a6a65ebdee94c96d85e90a50fa1a1d217c6298601a83a9e9281304c8e5b9ce1939

    Download Submit

  • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    Filesize

    1.3MB

    MD5

    7ce6eb49ff4fc6ef3e0377350007716b

    SHA1

    7b9df8411f4fdcf70f135acbbc9eb34134a1daa9

    SHA256

    a8f27059b43089c37bc291c9dc48031e473901dc3389140767e54cebaec377f2

    SHA512

    d3f97212bfd15d36a46b05258c109cf9e59764ece283766253da276f86f6ac59cf6910f54cdb66c58b231146445543ce46c6923d86138dbfcf9336fd52352c97

    Download Submit

  • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    Filesize

    1.2MB

    MD5

    7ee5fc1641639ae18598d98cfbc44793

    SHA1

    d9822e9e47fb91fd211bf478fa5ed3d65b6620d3

    SHA256

    ba4a667582f16bb5d14dce1a421c6873706e39bc5d2a3d50cac36e5ded4b1304

    SHA512

    b5b3310fa1fa3ee0bb67018bdf11195ebda0c40ecf35c3c5d882e24e3bb4db807c1c8b44585ee84ddccda7e28d46512591a03aabefdad51ad544d453aae864dc

    Download Submit

  • \Windows\System32\Locator.exe
    Filesize

    1.2MB

    MD5

    ba6f8078da13e01eaffc64ad9a30dbde

    SHA1

    baec2532da1583360542ea48934b629fe80f99e6

    SHA256

    851634de6bcaeec404bd378135f97f92159c11fcad86f0d7512cd94657bb4cca

    SHA512

    2cff8e9221c73f4a8935ad5f152cebfbbb07acfbbb9e0fa5360b27990f45b72a1ea47518c374538484c7c8fccd1d84e184099bd79f1f1a453188ea23e0bb1b30

    Download Submit

  • \Windows\System32\alg.exe
    Filesize

    1.3MB

    MD5

    9cd343bc83279b5425e5d8b2c1531925

    SHA1

    8dda3d81b9a92b2ef3f6a7299ae5b6dbcc1f49f0

    SHA256

    ca1a908a06e63513cb911331e682444ccd8cbd31512337566722b0bf58163355

    SHA512

    7443f671346b543d64b3d2c15a9880b6b79a6b21cf2d877fd3f1f3073cef6cc9a48f2d89d492772b384d47722ebe3406bb27d96bdab8008570a8402a5aebc5b1

    Download Submit

  • \Windows\System32\dllhost.exe
    Filesize

    1.2MB

    MD5

    f0b1c876bfb010b34bdd09a9288d83e9

    SHA1

    41da03498f61d0b93c96bff87ab31436736e725a

    SHA256

    0862a6c4b7678e142c8923e56c1b97f0f4644874988c20ba83c011e4b6bb836b

    SHA512

    cf8c348a8cb5682e7df5cc8386ca3dbfd55f810072c9afa7f6bcdd737a6d0f357d26057d6f99df2536683332d0510905e535bae3e0932f340f14372cf8512c7f

    Download Submit

  • \Windows\System32\msdtc.exe
    Filesize

    1.3MB

    MD5

    eb8c8da56f0d27064ae4cab2fe7444ae

    SHA1

    ceb25ce857b7f4f8a84b55ee420d1126bdfeecb6

    SHA256

    72fbf72a7be720006577020391fa0d578fe9f3232889b670a555c44c645a8da0

    SHA512

    035134ab39f20f960ff105fb99e164ec8e40c4a60347cebbe815cbaf383fb94b6ff7fa402a2a5a39ba6e1c92ff377bdb51d23e8c8b66acbf8f66fdadf4b1aa40

    Download Submit

  • \Windows\System32\msiexec.exe
    Filesize

    1.3MB

    MD5

    a879edf31db938c0cf063fee11c41e66

    SHA1

    f2d76a2a56f255b94088156297cc9eb6cfe5fe79

    SHA256

    1fb5706e5e197057cb09d3ddc7bb8634c673e7feb3e40b6b94a1b7ef5b978c1c

    SHA512

    3321503dcbbdd41d749907868642b4481f81e4ed10a65f356175aa9c2f62432fc76bb11738be29d71ce1beb5b6cacde7cd40b999f6db43b0dbdce3c80c496c95

    Download Submit

  • \Windows\System32\msiexec.exe
    Filesize

    1.3MB

    MD5

    a879edf31db938c0cf063fee11c41e66

    SHA1

    f2d76a2a56f255b94088156297cc9eb6cfe5fe79

    SHA256

    1fb5706e5e197057cb09d3ddc7bb8634c673e7feb3e40b6b94a1b7ef5b978c1c

    SHA512

    3321503dcbbdd41d749907868642b4481f81e4ed10a65f356175aa9c2f62432fc76bb11738be29d71ce1beb5b6cacde7cd40b999f6db43b0dbdce3c80c496c95

    Download Submit

  • \Windows\System32\snmptrap.exe
    Filesize

    1.2MB

    MD5

    cbb34afb1b64e164b4d192e301488aae

    SHA1

    8b4630cc819147f4be0bf8f5d291cbc15d45209b

    SHA256

    ab33daf4823b277431cfdca6750d1829468b6030947cbdd8aef72132861258e6

    SHA512

    df18dfa317e91198cd4570f9cd030120d69679232959bf8933c6449a285c02a73f0fb7bfdc5ec91ebd96b5362c784351c679ae90d669abd30875a9f1de42c77a

    Download Submit

  • \Windows\System32\wbem\WmiApSrv.exe
    Filesize

    1.4MB

    MD5

    909260fc02114d3bf60bb76a4bb004e1

    SHA1

    c87552a2f6dc826d0f1eb719579c08753c2f0b3a

    SHA256

    41e139880e841c20385230a5a6a0c0e57117a847f12e9d6e48a228b677f29e2d

    SHA512

    d03737ee4d3cb97741a6c3c1415414446f9ec701ab61c633b63b3a13ade3736278d72d5c23f4fe9f1881000bd0f1c9efe60bfbefb51f49abec40d961c5263d52

    Download Submit

  • \Windows\System32\wbengine.exe
    Filesize

    2.0MB

    MD5

    f00a4c8cacd8e4b36235a90dbe18ba98

    SHA1

    3605bb2a65cbdf1c9425bb48a8ad5c806d631365

    SHA256

    6306dbfb07746105445e4232a6e1f7665cb9699711db5c4d4cdbb0de42f29db8

    SHA512

    be43b08d19bc3516e542f901a3f9d00c12fdfbb428f1e94126069801d3f56b6dd9525b61ea2e42a72639c5bca02e0c6d4233d158c5df8f88ae11749d7c170234

    Download Submit

  • \Windows\ehome\ehrecvr.exe
    Filesize

    1.2MB

    MD5

    45a9e87fb1b0db3e19a6dffbe32d86a9

    SHA1

    b7231016aa2b1d433ad366bd67d0b1775268c2bb

    SHA256

    2ebb92abd14df025a7411d922de39e3bd3c496bbdc22e43eb8b272c89f6d1d60

    SHA512

    9232e53c65748dac558c8db6c57f1a41d8b68acad1e9cbb511e7950f538e6d33aaa00d941346f604972d37bf8b4ea7bae5541ec27a518a6097a803ba7aa1cc68

    Download Submit

  • \Windows\ehome\ehsched.exe
    Filesize

    1.3MB

    MD5

    1fd0d33431ea07b29962538b4e8cfbf4

    SHA1

    3bebc11035ff55fd64e792ea0ada409ec76295a1

    SHA256

    0687d95adad84bf04c01938dc91283fdd499bb9e7af55477b22b03eb8610ed54

    SHA512

    efc401d0c8aeadb2e03cbba3dcc0eda9f3dc827dee3e9d84c0ea2d8001154508678ad87ee78e2ac4235a11dcacc1e6ff2b646b113b3bbdbcf2f9c868dcde3fa5

    Download Submit

  • memory/792-395-0x00000000737E8000-0x00000000737FD000-memory.dmp

    Filesize

    84KB

    Download

  • memory/792-351-0x0000000100000000-0x0000000100542000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/792-381-0x0000000100000000-0x0000000100542000-memory.dmp

    Filesize

    5.3MB

    Download

  • memory/904-384-0x0000000100000000-0x0000000100253000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/920-379-0x0000000100000000-0x00000001001D5000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1064-333-0x0000000000550000-0x0000000000741000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1064-363-0x0000000000550000-0x0000000000741000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1064-356-0x0000000100000000-0x00000001001F1000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1064-330-0x0000000100000000-0x00000001001F1000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1212-279-0x0000000140000000-0x00000001401ED000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1212-131-0x0000000000440000-0x00000000004A0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1212-132-0x0000000140000000-0x00000001401ED000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1212-138-0x0000000000440000-0x00000000004A0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1252-122-0x0000000000350000-0x00000000003B7000-memory.dmp

    Filesize

    412KB

    Download

  • memory/1252-115-0x0000000000400000-0x00000000005E7000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1252-116-0x0000000000350000-0x00000000003B7000-memory.dmp

    Filesize

    412KB

    Download

  • memory/1252-188-0x0000000000400000-0x00000000005E7000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1388-271-0x0000000000A80000-0x0000000000B00000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1388-331-0x000007FEF4900000-0x000007FEF529D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1388-270-0x000007FEF4900000-0x000007FEF529D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1388-327-0x0000000000A80000-0x0000000000B00000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1388-315-0x000007FEF4900000-0x000007FEF529D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1388-277-0x000007FEF4900000-0x000007FEF529D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1388-382-0x0000000000A80000-0x0000000000B00000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1388-352-0x0000000000A80000-0x0000000000B00000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1388-316-0x0000000000A80000-0x0000000000B00000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1536-147-0x0000000010000000-0x00000000101E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1536-107-0x0000000010000000-0x00000000101E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1616-357-0x0000000001000000-0x00000000011D5000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1700-314-0x0000000140000000-0x0000000140237000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/1700-187-0x0000000000310000-0x0000000000370000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1700-180-0x0000000140000000-0x0000000140237000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/1700-181-0x0000000000310000-0x0000000000370000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1740-308-0x0000000001430000-0x0000000001431000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1740-165-0x0000000001380000-0x0000000001390000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1740-284-0x0000000140000000-0x000000014013C000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1740-167-0x0000000001390000-0x00000000013A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1740-151-0x0000000000840000-0x00000000008A0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1740-158-0x0000000000840000-0x00000000008A0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1740-176-0x0000000001430000-0x0000000001431000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1740-152-0x0000000140000000-0x000000014013C000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1972-394-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1972-366-0x0000000000400000-0x00000000005E7000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1972-373-0x0000000000860000-0x00000000008C7000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2080-376-0x0000000100000000-0x00000001001D4000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2100-159-0x0000000100000000-0x00000001001E3000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2100-31-0x0000000100000000-0x00000001001E3000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2256-174-0x0000000140000000-0x00000001401F1000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2256-286-0x0000000140000000-0x00000001401F1000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2256-166-0x0000000000850000-0x00000000008B0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2256-173-0x0000000000850000-0x00000000008B0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2480-340-0x000000002E000000-0x000000002E1F4000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2480-365-0x000000002E000000-0x000000002E1F4000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2480-347-0x0000000000300000-0x0000000000367000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2520-303-0x0000000140000000-0x0000000140209000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2520-323-0x0000000140000000-0x0000000140209000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2520-324-0x0000000000A00000-0x0000000000A60000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2520-310-0x0000000000A00000-0x0000000000A60000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2672-319-0x0000000140000000-0x00000001401F5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2672-353-0x0000000140000000-0x00000001401F5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2708-300-0x0000000000420000-0x0000000000487000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2708-346-0x000000002E000000-0x000000002FE1E000-memory.dmp

    Filesize

    30.1MB

    Download

  • memory/2708-297-0x000000002E000000-0x000000002FE1E000-memory.dmp

    Filesize

    30.1MB

    Download

  • memory/2776-98-0x0000000010000000-0x00000000101DE000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2776-112-0x0000000010000000-0x00000000101DE000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2940-140-0x0000000000400000-0x00000000005CD000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2940-0-0x0000000000400000-0x00000000005CD000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2940-1-0x00000000005D0000-0x0000000000637000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2940-7-0x00000000005D0000-0x0000000000637000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2940-263-0x0000000000400000-0x00000000005CD000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2940-6-0x00000000005D0000-0x0000000000637000-memory.dmp

    Filesize

    412KB

    Download

  • memory/2948-93-0x0000000000A50000-0x0000000000AB0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2948-164-0x0000000140000000-0x00000001401DC000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2948-92-0x0000000000A50000-0x0000000000AB0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2948-86-0x0000000000A50000-0x0000000000AB0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2948-77-0x0000000140000000-0x00000001401DC000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2992-267-0x00000000008D0000-0x0000000000930000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2992-275-0x0000000100000000-0x00000001001D4000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2992-329-0x0000000100000000-0x00000001001D4000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2992-282-0x00000000008D0000-0x0000000000930000-memory.dmp

    Filesize

    384KB

    Download