Analysis

  • max time kernel
    95s
  • max time network
    164s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 06:10

General

  • Target

    94281e14a9f2b3b6df0305792c6d78124b9d1fdc80468cdf0e6d0ee7e393e9ea.exe

  • Size

    1.8MB

  • MD5

    b70fa8321c8c32af8d4cf8bc6c89f4bb

  • SHA1

    3004f39e8046d3c061c94fd5f306e5436cf01bc8

  • SHA256

    94281e14a9f2b3b6df0305792c6d78124b9d1fdc80468cdf0e6d0ee7e393e9ea

  • SHA512

    50ff61bb6abd64d5043588b6e7f2ee7fb175effb0b6dd6fe0122d22d7c58bd1828cc412878dbb804fa0987a2b57fcb43a3ccbb60d8e5c15d86d4c0292745f1e6

  • SSDEEP

    49152:bKJ0WR7AFPyyiSruXKpk3WFDL9zxnSBaB0zj0yjoB2:bKlBAFPydSS6W6X9lnfB2Yyjl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 32 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\94281e14a9f2b3b6df0305792c6d78124b9d1fdc80468cdf0e6d0ee7e393e9ea.exe
    "C:\Users\Admin\AppData\Local\Temp\94281e14a9f2b3b6df0305792c6d78124b9d1fdc80468cdf0e6d0ee7e393e9ea.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2232
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2720
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2964
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1656
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1348
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 24c -NGENProcess 258 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 260 -NGENProcess 250 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
        PID:2416
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:884
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2880
    • C:\Windows\system32\dllhost.exe
      C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2908
    • C:\Windows\ehome\ehsched.exe
      C:\Windows\ehome\ehsched.exe
      1⤵
      • Executes dropped EXE
      PID:2032
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:892
    • C:\Windows\system32\IEEtwCollector.exe
      C:\Windows\system32\IEEtwCollector.exe /V
      1⤵
      • Executes dropped EXE
      PID:784
    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:1832
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1720
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:440
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2364
    • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1292
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1648
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2112
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1768
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:1600
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:2740
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2612
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2764
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:2832
    • C:\Program Files\Windows Media Player\wmpnetwk.exe
      "C:\Program Files\Windows Media Player\wmpnetwk.exe"
      1⤵
        PID:2504
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
          PID:1956
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3849525425-30183055-657688904-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3849525425-30183055-657688904-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
            2⤵
              PID:2068
            • C:\Windows\system32\SearchFilterHost.exe
              "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
              2⤵
                PID:2276

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              1.6MB

              MD5

              b674124c4cbb6358baf2bcfe4055b9e3

              SHA1

              ecd23ac46649a9f2a9e99641a8a53401ef6cd388

              SHA256

              7b1482fd99080268608d7011d0f955b1b43d8edac586a59a03ca43976aeea77d

              SHA512

              3d09d000dfa495f2e9bac341a53825329363ccfd87110ac98237dfde8fc7105cfaf2999e268d7aca23f154ec81b2e6adab1d07b0cdf9638869873cc974a23a71

            • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

              Filesize

              30.1MB

              MD5

              6280cd4b2debe84db23cb5199c7571e8

              SHA1

              8050dc228e31578248011f268aa87a59810ec2d8

              SHA256

              6e7750ec9c6bee4721ecdc58a98c381cc8f363aec33125c79ec8973ae39b3816

              SHA512

              bf5c30b3617a9aa51a223026cb49b5eaf50a8e8888b189140e376e1be12f0c3507809f16b09862c092a0ce36b21a588ecfc563b2ac7ee6b457852e4bb6949ecb

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              1.6MB

              MD5

              ce4796aed5983f459dff1e7f2cd4e0cd

              SHA1

              397b9ee375b6ab8a39234446b64c8093a5218a1b

              SHA256

              e1e850a30d3ed711c64ccb0ed7948c925d485f4ece10879716ff08da12c1a50b

              SHA512

              1948431072a1ae0501495db8d9246b5d8193e3a73cff13db54d7e607f6315108b52e5ed1d63d6e4af691e6fc7cdff4984dd46d93475926c0dbb288b701498db0

            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

              Filesize

              5.2MB

              MD5

              b244e7fc65767bc4820cb118aac0f996

              SHA1

              c0ceefec0f8764d11a5e221d9684b972fc5ff6f1

              SHA256

              14c1db765e6e8de584a96851ccc31e1b61d84a55a0aff96956d9850391bd344a

              SHA512

              0cc4382598f35d01e2d30dcc7a371d85d8819d07fc866fa22ab4a8a475564792c2c6a6f365dba0cda25a80bd18ac15313af31b17b983109a0c70b5efd2b2bfad

            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

              Filesize

              2.1MB

              MD5

              c14615e963dad6f3c1544b9f0b841912

              SHA1

              a9e09c5c75feff450e50b54b17d444f9059312b6

              SHA256

              433368337399531d46a1557a2b848b4d9b017a91ec0a4dfd78a6f7842fc747ab

              SHA512

              eab322eefc840c124875182ddc6ad2cf6948827cf87112091b4e92804a0960737707b6de8a88207cf7a12bde13fdfcda291cc8bdf40a94808f18f39eeca6c158

            • C:\Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              2.0MB

              MD5

              eb5b5f2548537e461a20a52977e651ad

              SHA1

              48df0227a5d358e0341412e1e86bc1d4c2bea2e9

              SHA256

              cb7282cae9e56e226cff83e0d40d04ea472b7849e50afd326641a9d6b9f2b584

              SHA512

              e9f38e167b2d1743f0516ddbc24303fb705e748607518e2793e180031e8f9ffdf1e4187dec44ae7cd3ae35113858c9fcabdfabd2d3388c6af15e4c1005f0bd26

            • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

              Filesize

              1024KB

              MD5

              faaaa0039e6a3a83df1b588098851720

              SHA1

              f1572f6079c9aaf7ee37775d1178e16d96974f83

              SHA256

              a7071657c24fa51b638a0919875f5039665f8316afec0fcdec5b2b3844a83295

              SHA512

              eb82c9be1aa4c84ee7cdf2aaad66396773933794a95a009cd9aa391c5ae8c08b74d8ecbebc0934e35593fac21c36d6687d61b71e61e40dfee8f88a26cf691a21

            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              340f5dcbf3b3409c683f1b76988e5717

              SHA1

              e561b15cef69283c5c6cc46ef8767508565dc54a

              SHA256

              e9a67aa3afe55f18b608debcc1834f226fd590fb0d1e3438a42016fcdf8abb62

              SHA512

              736c091b16e9d259cdd5a5110ba5ca86852140f91ffcb4228f4982a0e41539b79d8a43fed55963ae245c84cf517615968810e52b0c2519ed208f4bd1ed864fce

            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              340f5dcbf3b3409c683f1b76988e5717

              SHA1

              e561b15cef69283c5c6cc46ef8767508565dc54a

              SHA256

              e9a67aa3afe55f18b608debcc1834f226fd590fb0d1e3438a42016fcdf8abb62

              SHA512

              736c091b16e9d259cdd5a5110ba5ca86852140f91ffcb4228f4982a0e41539b79d8a43fed55963ae245c84cf517615968810e52b0c2519ed208f4bd1ed864fce

            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

              Filesize

              872KB

              MD5

              fa2288a1f2792610d643a5c51570af0c

              SHA1

              b0c4361f56e17aee52b23ab81cc546d2b9687fc8

              SHA256

              7b77126e92a852a4794bc4274f5bb23aa397aef3859ed500d01c661e17ea7852

              SHA512

              47c57fa07ad32a88e3573f8015e639ca7c9a00cc52b4fddff4524a072ce041ce44761a8fef65e2a5ccdad52b87773167ec145b6218de2962d47c8dc262b68334

            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

              Filesize

              1.5MB

              MD5

              922588de77a05e6d6e8121a8505a1fa8

              SHA1

              9afe597168e79f04b8326772c1a16f9ef47cb630

              SHA256

              d6fa60caa69e2acc4034c76a625c1d6211ab0ed9add74aec746d56252825415e

              SHA512

              32f024b0032a63be3e4b50466dbfe2892c7aeede10c4435a15951c268fd76d6877ef31c68f629d49c1b6a00819103649ec148dfaebf5f1685e7e7401258bb8fe

            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              6773ef802d64556322fc140c85764ac6

              SHA1

              99292ac8c3221b8e02f99dc52b99fa86cb74604b

              SHA256

              16b97ffe671a9a05cbd6ced11aa9b94c5cbb07955c8ecdb5130c20eda54e874c

              SHA512

              95fd0427083b68094c1fdf18f4cb7bb3caef883bf746a4980225602b2b53181f86720ad02aa54cfd0ad4cc4d56ddf3c12112b23f5b0f29fdc1385cf4849498ed

            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              6773ef802d64556322fc140c85764ac6

              SHA1

              99292ac8c3221b8e02f99dc52b99fa86cb74604b

              SHA256

              16b97ffe671a9a05cbd6ced11aa9b94c5cbb07955c8ecdb5130c20eda54e874c

              SHA512

              95fd0427083b68094c1fdf18f4cb7bb3caef883bf746a4980225602b2b53181f86720ad02aa54cfd0ad4cc4d56ddf3c12112b23f5b0f29fdc1385cf4849498ed

            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              6773ef802d64556322fc140c85764ac6

              SHA1

              99292ac8c3221b8e02f99dc52b99fa86cb74604b

              SHA256

              16b97ffe671a9a05cbd6ced11aa9b94c5cbb07955c8ecdb5130c20eda54e874c

              SHA512

              95fd0427083b68094c1fdf18f4cb7bb3caef883bf746a4980225602b2b53181f86720ad02aa54cfd0ad4cc4d56ddf3c12112b23f5b0f29fdc1385cf4849498ed

            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              6773ef802d64556322fc140c85764ac6

              SHA1

              99292ac8c3221b8e02f99dc52b99fa86cb74604b

              SHA256

              16b97ffe671a9a05cbd6ced11aa9b94c5cbb07955c8ecdb5130c20eda54e874c

              SHA512

              95fd0427083b68094c1fdf18f4cb7bb3caef883bf746a4980225602b2b53181f86720ad02aa54cfd0ad4cc4d56ddf3c12112b23f5b0f29fdc1385cf4849498ed

            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              7ae983c2b127db36debf8036a27a0446

              SHA1

              f0799db19fcd2eebc1456796b33b01918399ee58

              SHA256

              04cd345fab36452e87ad99d30301e371dc19cd561297674529c11cecbe42e2b1

              SHA512

              db51d069cf9e474fd9bddbbdd7e22f26b4ec93fc703f11f170b5751928f7d9840813c88f890dcee2a99d078601b242a99ff6079a2c558b3599f08fe48860b873

            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              7ae983c2b127db36debf8036a27a0446

              SHA1

              f0799db19fcd2eebc1456796b33b01918399ee58

              SHA256

              04cd345fab36452e87ad99d30301e371dc19cd561297674529c11cecbe42e2b1

              SHA512

              db51d069cf9e474fd9bddbbdd7e22f26b4ec93fc703f11f170b5751928f7d9840813c88f890dcee2a99d078601b242a99ff6079a2c558b3599f08fe48860b873

            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

              Filesize

              1003KB

              MD5

              fadc1308ad5a436ac1af5f0676545b57

              SHA1

              78b82e4d49917bc1810b428f1afc36ca8a5f6a16

              SHA256

              3c5c2725db12950a6bae157e36250d96bfa5888deb9cfbb294a5e8f1ced6ba8e

              SHA512

              d0cfe8b1a668f844dfd91f201a5083978176c64cf48b516298bcb1cb27df5985215b5e7bdc7d79ad0ffbe68eb253f695a91b100c98d19a5890489a5d8ed8eb41

            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              2fe3009ed0a37fe24f250b209f0bed0a

              SHA1

              503d71e5402d00360c4e03607629cefbc47bb92e

              SHA256

              86f4b62f11a759ffe1e1a2629de295d935842307049ef73082f58173051014c1

              SHA512

              8ea39e84ad40fca56de23439e0a844ce5612992a8488eff55e68ea758576cd6f9bb7b6b4aae3734519ee2e22661eb4f2a4b54fabb4b0e5c96735ec9bbdce20a1

            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              2fe3009ed0a37fe24f250b209f0bed0a

              SHA1

              503d71e5402d00360c4e03607629cefbc47bb92e

              SHA256

              86f4b62f11a759ffe1e1a2629de295d935842307049ef73082f58173051014c1

              SHA512

              8ea39e84ad40fca56de23439e0a844ce5612992a8488eff55e68ea758576cd6f9bb7b6b4aae3734519ee2e22661eb4f2a4b54fabb4b0e5c96735ec9bbdce20a1

            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              2fe3009ed0a37fe24f250b209f0bed0a

              SHA1

              503d71e5402d00360c4e03607629cefbc47bb92e

              SHA256

              86f4b62f11a759ffe1e1a2629de295d935842307049ef73082f58173051014c1

              SHA512

              8ea39e84ad40fca56de23439e0a844ce5612992a8488eff55e68ea758576cd6f9bb7b6b4aae3734519ee2e22661eb4f2a4b54fabb4b0e5c96735ec9bbdce20a1

            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              2fe3009ed0a37fe24f250b209f0bed0a

              SHA1

              503d71e5402d00360c4e03607629cefbc47bb92e

              SHA256

              86f4b62f11a759ffe1e1a2629de295d935842307049ef73082f58173051014c1

              SHA512

              8ea39e84ad40fca56de23439e0a844ce5612992a8488eff55e68ea758576cd6f9bb7b6b4aae3734519ee2e22661eb4f2a4b54fabb4b0e5c96735ec9bbdce20a1

            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              2fe3009ed0a37fe24f250b209f0bed0a

              SHA1

              503d71e5402d00360c4e03607629cefbc47bb92e

              SHA256

              86f4b62f11a759ffe1e1a2629de295d935842307049ef73082f58173051014c1

              SHA512

              8ea39e84ad40fca56de23439e0a844ce5612992a8488eff55e68ea758576cd6f9bb7b6b4aae3734519ee2e22661eb4f2a4b54fabb4b0e5c96735ec9bbdce20a1

            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              2fe3009ed0a37fe24f250b209f0bed0a

              SHA1

              503d71e5402d00360c4e03607629cefbc47bb92e

              SHA256

              86f4b62f11a759ffe1e1a2629de295d935842307049ef73082f58173051014c1

              SHA512

              8ea39e84ad40fca56de23439e0a844ce5612992a8488eff55e68ea758576cd6f9bb7b6b4aae3734519ee2e22661eb4f2a4b54fabb4b0e5c96735ec9bbdce20a1

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              1.4MB

              MD5

              adf9370767a8acc04f23c61586e84e58

              SHA1

              4cbfe446ae3c30717df7a292871107bbb1c6cd64

              SHA256

              8bdd6c4f56c31225f1905afe36dd7c5741dd3eba5fd89fc93eb5c53cd707bdb9

              SHA512

              df5493479393360e7cd80d7c2213716225b42176631990db89db5ed79e716fe21cd12a18edc303d956c135ace180faca91a2e74d19a40459d8ad0014c3bea19c

            • C:\Windows\System32\Locator.exe

              Filesize

              1.4MB

              MD5

              76f5001f0eeadf95d734b7a44bb3a94a

              SHA1

              0756ea9668bfbe40042a9347022cbe36440f9736

              SHA256

              7ee6e580b08590dd9caeb9e8875f6ee3a7cd7dc6ac06a1185f99fd1103a679d0

              SHA512

              861b987e75ee25be9a6bdde6c984e3e01b2d7482a9b25a26fb29dec2e43fc4811a7ae7b4a57549c3ab572a614e5ce5f60703a673a36010c5d69c611ca28a6dfd

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.1MB

              MD5

              5f184f4da7dc9ff939792c19b062eb1f

              SHA1

              82fb484a93dfa8cf98f7204ea1f1e1c652d24185

              SHA256

              5a91e7d4d9300145dec31b6ced3d81a16daf18f1f1d5d218ac751d3b64d0a8fc

              SHA512

              40d6459ca9b700ff706ea68ed635a391049c8211d80c115860330ec35cbf0a5f5da8cd74b6d7552c1896a835f7b721529ca7245a1a4c7fad45ca76c638d981b1

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.1MB

              MD5

              fa990eb99df35f6ee7060e13a2c8f809

              SHA1

              2108d89a229da8ff080a4c2bd0d49cd273dcc442

              SHA256

              ac04cdf1d4d491248bb38ab2c3907e0e750c8bdbed08064a3078dabb265c8f20

              SHA512

              52acc46e3e6c7709f9ff907e9b68d2bd999724cadfdcb9248f16b47877d6a376fa973498fb6d33cf459bd2be3bc29f14e30334ebfd101cd3e5454de1cd9fe7df

            • C:\Windows\System32\alg.exe

              Filesize

              1.5MB

              MD5

              d89fb42fba5d1d73f852274f38bcd531

              SHA1

              d42c694870b805fac1d030ddebd1b48b9d3d68fa

              SHA256

              6310014e2a715048dd535078b4f8bb434aabf593e66d2a57935dd5160a8c4659

              SHA512

              6d9cd3d27b17abca202130dfa74d9fab7ddca6a8c39a76accc5a41a3bc9c2db9c215bbdcff3186e9c3fe6936a5d27b50c5673674c03a40d2474fa915877382e3

            • C:\Windows\System32\dllhost.exe

              Filesize

              1.4MB

              MD5

              9ce1d98c214042aea4585d93b83a4e8a

              SHA1

              e98342559d902789884610d75387cc8a53d910c1

              SHA256

              9262c480fb9108f9690f50a7f4c8cfd6e14bb3ec348b5fe36280761148754e17

              SHA512

              af6b0ec884505fd9cad635d420683aff91e87745666446e0856c2e6d32b6dd455662e3161e8453ed2f4fd3538e0194726da8f3c429798fce8db9469656e3367d

            • C:\Windows\System32\ieetwcollector.exe

              Filesize

              1.5MB

              MD5

              f755e2403198d5ee2d8ddba344f9219a

              SHA1

              fc8e6f51c2be78f2339a11d11ab4120138101092

              SHA256

              ae02cde12c97c1a770776de44b0f5ad9bda8421e3633944c3d9d1e010d98c30b

              SHA512

              54f54c1421def9950cdda6252bd3f68be839fc3a356867f5aed7d17bfbae98250835fab3e957ebc2413937e6156c81221e490d63c5ab7af5fb77a72ce658a1be

            • C:\Windows\System32\msdtc.exe

              Filesize

              1.6MB

              MD5

              053ce4a6248662507e89110ffa2b3551

              SHA1

              c39c4f807462441684cc1d36cfa4e9cc2959770f

              SHA256

              0f603eb1987db1750936585aebf856a769832c370aae304b8b8e9d901255fe9f

              SHA512

              aa49608389ebe529f4f2198d43a6508ff38ce37b88e557186a6d08325502aa98288044bf0248aae214a35e6020f6f2b688dba7613369d804bc9aab14c6f4d857

            • C:\Windows\System32\msiexec.exe

              Filesize

              1.6MB

              MD5

              cf9d019f8df3426d812f391effa72bfd

              SHA1

              36daa33d4bb335d5980478e0d3484a285e5f8dd7

              SHA256

              e998fc443a1027f685cbac63e9a88052b7ebd5f931fe573f17550c5446e9c112

              SHA512

              a0cdebf2a17ebc8f50007055046ab3e67e327f7612f13381af231f91938b9fe0249b5f449eb83d34b87549d196c686876c35c3639d0b3721dd712d8de8d66a5c

            • C:\Windows\System32\snmptrap.exe

              Filesize

              1.4MB

              MD5

              d3e7c0e0b36bce688ff597a817a3620a

              SHA1

              17f5445d74e5a93fe1b73b6bc913666a965a8e41

              SHA256

              2d98e8e5d4384f3ab5733492ee4fc9e6e2d32dc72a04b96dbcd47b800335df73

              SHA512

              ba7187e58a51ac35c6d63ed08602853c131620f8452e8a11263ae7ff5dcf882af9b42a9f3dffeb6be53a5ae3446feac1487017c9deeba595fb720d5d6a3ec67f

            • C:\Windows\System32\vds.exe

              Filesize

              1.9MB

              MD5

              a396de0c5517f1258377711668522ec1

              SHA1

              da976e4b64b2421b767a9557352e137b54c6f92d

              SHA256

              1939418f9bba2114d9a36238daa69efc91dd0b12500122d9ba927fdb3c771a0b

              SHA512

              74f8b3ae419ada019ab3728274529eb27716138e30c7b62d0f61a512d3a4a1443b9b70fc79b0a43d8bb6be8eb036b1ea276687c6490ea8f5ee9650f9f33455f9

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              1.6MB

              MD5

              fa2dc45edfe91a18cb613bc7963dfbe6

              SHA1

              044efe3d78aca740f82cb6415425f3b7740853a2

              SHA256

              b35387e38ff6ec68338e56b58653fe2f0f00dfdaa32334e2df1be5c22427fe9e

              SHA512

              d2823d6adcfdfbaa89ad25a8c6d216abb35435d817f2ef1cd0d0cf66f4d39448c3a23aea6a8a0ccef2a74c50b8732997f5f5492c5e97c9677b91e2fd984b02cc

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.0MB

              MD5

              1fc62f162e56b34a28724790b66c2a57

              SHA1

              18860093a91ed19334a185dfe618640effb3bed3

              SHA256

              6969d1191dc8c429e1501dfdbcfea0f4d81800f5a866949f81ee76b981e72108

              SHA512

              9eca608cb33f4144a2179100d4a1e97f9cdcc272b611200a511c67917235c11e521c4a2152f956b878b4ac66826aa165d19f73d339e24969f858e43d5a9cdd96

            • C:\Windows\ehome\ehRecvr.exe

              Filesize

              1.2MB

              MD5

              8c5efdede4dedc6c74a33319ba776493

              SHA1

              779cfd9221d07cef86af66256504cfa97273ec93

              SHA256

              855b942d61ef780aafa133c9c2c2a710f43adb22bcd99b040571d06aa6f3d9d7

              SHA512

              0c3eef277bb16cf3c55180de6536e8e05b3c8d13b1cb792f9d06c6fe75568ae1537e28bf10729180d467e50cdfaaab07c65405f7c5bc454b0b565c4bba2d0376

            • C:\Windows\ehome\ehsched.exe

              Filesize

              1.6MB

              MD5

              9da569c3c9868c2d0af7adcbc00f61c5

              SHA1

              c0102bd0000d1f90fff7761dc8b6d9b7ec418ba4

              SHA256

              d718e684404f585b39052e23a89a36e692c196c49140ebad6a21ed2558ddfb47

              SHA512

              f7193cdaa94a46673451684c31177059888bdb76f810c5c5540d2937d82f6d13102123f610abf9aaf4fa3c07c6e014420a037fab9a1b6c705ff6388126756474

            • C:\Windows\system32\msiexec.exe

              Filesize

              1.6MB

              MD5

              cf9d019f8df3426d812f391effa72bfd

              SHA1

              36daa33d4bb335d5980478e0d3484a285e5f8dd7

              SHA256

              e998fc443a1027f685cbac63e9a88052b7ebd5f931fe573f17550c5446e9c112

              SHA512

              a0cdebf2a17ebc8f50007055046ab3e67e327f7612f13381af231f91938b9fe0249b5f449eb83d34b87549d196c686876c35c3639d0b3721dd712d8de8d66a5c

            • \Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              2.0MB

              MD5

              eb5b5f2548537e461a20a52977e651ad

              SHA1

              48df0227a5d358e0341412e1e86bc1d4c2bea2e9

              SHA256

              cb7282cae9e56e226cff83e0d40d04ea472b7849e50afd326641a9d6b9f2b584

              SHA512

              e9f38e167b2d1743f0516ddbc24303fb705e748607518e2793e180031e8f9ffdf1e4187dec44ae7cd3ae35113858c9fcabdfabd2d3388c6af15e4c1005f0bd26

            • \Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              2.0MB

              MD5

              eb5b5f2548537e461a20a52977e651ad

              SHA1

              48df0227a5d358e0341412e1e86bc1d4c2bea2e9

              SHA256

              cb7282cae9e56e226cff83e0d40d04ea472b7849e50afd326641a9d6b9f2b584

              SHA512

              e9f38e167b2d1743f0516ddbc24303fb705e748607518e2793e180031e8f9ffdf1e4187dec44ae7cd3ae35113858c9fcabdfabd2d3388c6af15e4c1005f0bd26

            • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

              Filesize

              1.5MB

              MD5

              340f5dcbf3b3409c683f1b76988e5717

              SHA1

              e561b15cef69283c5c6cc46ef8767508565dc54a

              SHA256

              e9a67aa3afe55f18b608debcc1834f226fd590fb0d1e3438a42016fcdf8abb62

              SHA512

              736c091b16e9d259cdd5a5110ba5ca86852140f91ffcb4228f4982a0e41539b79d8a43fed55963ae245c84cf517615968810e52b0c2519ed208f4bd1ed864fce

            • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

              Filesize

              1.5MB

              MD5

              922588de77a05e6d6e8121a8505a1fa8

              SHA1

              9afe597168e79f04b8326772c1a16f9ef47cb630

              SHA256

              d6fa60caa69e2acc4034c76a625c1d6211ab0ed9add74aec746d56252825415e

              SHA512

              32f024b0032a63be3e4b50466dbfe2892c7aeede10c4435a15951c268fd76d6877ef31c68f629d49c1b6a00819103649ec148dfaebf5f1685e7e7401258bb8fe

            • \Windows\System32\Locator.exe

              Filesize

              1.4MB

              MD5

              76f5001f0eeadf95d734b7a44bb3a94a

              SHA1

              0756ea9668bfbe40042a9347022cbe36440f9736

              SHA256

              7ee6e580b08590dd9caeb9e8875f6ee3a7cd7dc6ac06a1185f99fd1103a679d0

              SHA512

              861b987e75ee25be9a6bdde6c984e3e01b2d7482a9b25a26fb29dec2e43fc4811a7ae7b4a57549c3ab572a614e5ce5f60703a673a36010c5d69c611ca28a6dfd

            • \Windows\System32\alg.exe

              Filesize

              1.5MB

              MD5

              d89fb42fba5d1d73f852274f38bcd531

              SHA1

              d42c694870b805fac1d030ddebd1b48b9d3d68fa

              SHA256

              6310014e2a715048dd535078b4f8bb434aabf593e66d2a57935dd5160a8c4659

              SHA512

              6d9cd3d27b17abca202130dfa74d9fab7ddca6a8c39a76accc5a41a3bc9c2db9c215bbdcff3186e9c3fe6936a5d27b50c5673674c03a40d2474fa915877382e3

            • \Windows\System32\dllhost.exe

              Filesize

              1.4MB

              MD5

              9ce1d98c214042aea4585d93b83a4e8a

              SHA1

              e98342559d902789884610d75387cc8a53d910c1

              SHA256

              9262c480fb9108f9690f50a7f4c8cfd6e14bb3ec348b5fe36280761148754e17

              SHA512

              af6b0ec884505fd9cad635d420683aff91e87745666446e0856c2e6d32b6dd455662e3161e8453ed2f4fd3538e0194726da8f3c429798fce8db9469656e3367d

            • \Windows\System32\ieetwcollector.exe

              Filesize

              1.5MB

              MD5

              f755e2403198d5ee2d8ddba344f9219a

              SHA1

              fc8e6f51c2be78f2339a11d11ab4120138101092

              SHA256

              ae02cde12c97c1a770776de44b0f5ad9bda8421e3633944c3d9d1e010d98c30b

              SHA512

              54f54c1421def9950cdda6252bd3f68be839fc3a356867f5aed7d17bfbae98250835fab3e957ebc2413937e6156c81221e490d63c5ab7af5fb77a72ce658a1be

            • \Windows\System32\msdtc.exe

              Filesize

              1.6MB

              MD5

              053ce4a6248662507e89110ffa2b3551

              SHA1

              c39c4f807462441684cc1d36cfa4e9cc2959770f

              SHA256

              0f603eb1987db1750936585aebf856a769832c370aae304b8b8e9d901255fe9f

              SHA512

              aa49608389ebe529f4f2198d43a6508ff38ce37b88e557186a6d08325502aa98288044bf0248aae214a35e6020f6f2b688dba7613369d804bc9aab14c6f4d857

            • \Windows\System32\msiexec.exe

              Filesize

              1.6MB

              MD5

              cf9d019f8df3426d812f391effa72bfd

              SHA1

              36daa33d4bb335d5980478e0d3484a285e5f8dd7

              SHA256

              e998fc443a1027f685cbac63e9a88052b7ebd5f931fe573f17550c5446e9c112

              SHA512

              a0cdebf2a17ebc8f50007055046ab3e67e327f7612f13381af231f91938b9fe0249b5f449eb83d34b87549d196c686876c35c3639d0b3721dd712d8de8d66a5c

            • \Windows\System32\msiexec.exe

              Filesize

              1.6MB

              MD5

              cf9d019f8df3426d812f391effa72bfd

              SHA1

              36daa33d4bb335d5980478e0d3484a285e5f8dd7

              SHA256

              e998fc443a1027f685cbac63e9a88052b7ebd5f931fe573f17550c5446e9c112

              SHA512

              a0cdebf2a17ebc8f50007055046ab3e67e327f7612f13381af231f91938b9fe0249b5f449eb83d34b87549d196c686876c35c3639d0b3721dd712d8de8d66a5c

            • \Windows\System32\snmptrap.exe

              Filesize

              1.4MB

              MD5

              d3e7c0e0b36bce688ff597a817a3620a

              SHA1

              17f5445d74e5a93fe1b73b6bc913666a965a8e41

              SHA256

              2d98e8e5d4384f3ab5733492ee4fc9e6e2d32dc72a04b96dbcd47b800335df73

              SHA512

              ba7187e58a51ac35c6d63ed08602853c131620f8452e8a11263ae7ff5dcf882af9b42a9f3dffeb6be53a5ae3446feac1487017c9deeba595fb720d5d6a3ec67f

            • \Windows\System32\wbem\WmiApSrv.exe

              Filesize

              1.6MB

              MD5

              fa2dc45edfe91a18cb613bc7963dfbe6

              SHA1

              044efe3d78aca740f82cb6415425f3b7740853a2

              SHA256

              b35387e38ff6ec68338e56b58653fe2f0f00dfdaa32334e2df1be5c22427fe9e

              SHA512

              d2823d6adcfdfbaa89ad25a8c6d216abb35435d817f2ef1cd0d0cf66f4d39448c3a23aea6a8a0ccef2a74c50b8732997f5f5492c5e97c9677b91e2fd984b02cc

            • \Windows\System32\wbengine.exe

              Filesize

              2.0MB

              MD5

              1fc62f162e56b34a28724790b66c2a57

              SHA1

              18860093a91ed19334a185dfe618640effb3bed3

              SHA256

              6969d1191dc8c429e1501dfdbcfea0f4d81800f5a866949f81ee76b981e72108

              SHA512

              9eca608cb33f4144a2179100d4a1e97f9cdcc272b611200a511c67917235c11e521c4a2152f956b878b4ac66826aa165d19f73d339e24969f858e43d5a9cdd96

            • \Windows\ehome\ehsched.exe

              Filesize

              1.6MB

              MD5

              9da569c3c9868c2d0af7adcbc00f61c5

              SHA1

              c0102bd0000d1f90fff7761dc8b6d9b7ec418ba4

              SHA256

              d718e684404f585b39052e23a89a36e692c196c49140ebad6a21ed2558ddfb47

              SHA512

              f7193cdaa94a46673451684c31177059888bdb76f810c5c5540d2937d82f6d13102123f610abf9aaf4fa3c07c6e014420a037fab9a1b6c705ff6388126756474

            • memory/440-404-0x0000000140000000-0x0000000140196000-memory.dmp

              Filesize

              1.6MB

            • memory/756-338-0x00000000005E0000-0x0000000000647000-memory.dmp

              Filesize

              412KB

            • memory/756-373-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/756-328-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/756-353-0x0000000073C40000-0x000000007432E000-memory.dmp

              Filesize

              6.9MB

            • memory/756-370-0x0000000073C40000-0x000000007432E000-memory.dmp

              Filesize

              6.9MB

            • memory/784-356-0x0000000140000000-0x000000014018F000-memory.dmp

              Filesize

              1.6MB

            • memory/784-411-0x0000000140000000-0x000000014018F000-memory.dmp

              Filesize

              1.6MB

            • memory/884-298-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

              Filesize

              9.9MB

            • memory/884-302-0x0000000000AC0000-0x0000000000B20000-memory.dmp

              Filesize

              384KB

            • memory/884-303-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

              Filesize

              9.9MB

            • memory/884-301-0x0000000140000000-0x000000014018E000-memory.dmp

              Filesize

              1.6MB

            • memory/884-285-0x0000000000AC0000-0x0000000000B20000-memory.dmp

              Filesize

              384KB

            • memory/892-340-0x0000000140000000-0x0000000140237000-memory.dmp

              Filesize

              2.2MB

            • memory/892-393-0x0000000140000000-0x0000000140237000-memory.dmp

              Filesize

              2.2MB

            • memory/892-347-0x00000000008C0000-0x0000000000920000-memory.dmp

              Filesize

              384KB

            • memory/1348-115-0x0000000000660000-0x00000000006C0000-memory.dmp

              Filesize

              384KB

            • memory/1348-114-0x0000000010000000-0x0000000010188000-memory.dmp

              Filesize

              1.5MB

            • memory/1348-151-0x0000000010000000-0x0000000010188000-memory.dmp

              Filesize

              1.5MB

            • memory/1348-122-0x0000000000660000-0x00000000006C0000-memory.dmp

              Filesize

              384KB

            • memory/1656-97-0x0000000010000000-0x0000000010180000-memory.dmp

              Filesize

              1.5MB

            • memory/1656-98-0x00000000004A0000-0x0000000000507000-memory.dmp

              Filesize

              412KB

            • memory/1656-104-0x00000000004A0000-0x0000000000507000-memory.dmp

              Filesize

              412KB

            • memory/1656-143-0x0000000010000000-0x0000000010180000-memory.dmp

              Filesize

              1.5MB

            • memory/1708-360-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/1708-366-0x0000000000230000-0x0000000000297000-memory.dmp

              Filesize

              412KB

            • memory/1708-374-0x0000000073C40000-0x000000007432E000-memory.dmp

              Filesize

              6.9MB

            • memory/1720-387-0x0000000140000000-0x00000001401AB000-memory.dmp

              Filesize

              1.7MB

            • memory/1720-401-0x0000000000F90000-0x0000000000FF0000-memory.dmp

              Filesize

              384KB

            • memory/1720-400-0x0000000140000000-0x00000001401AB000-memory.dmp

              Filesize

              1.7MB

            • memory/1720-395-0x0000000000F90000-0x0000000000FF0000-memory.dmp

              Filesize

              384KB

            • memory/1832-372-0x000000002E000000-0x000000002FE1E000-memory.dmp

              Filesize

              30.1MB

            • memory/1832-381-0x00000000006A0000-0x0000000000707000-memory.dmp

              Filesize

              412KB

            • memory/2032-261-0x0000000000270000-0x00000000002D0000-memory.dmp

              Filesize

              384KB

            • memory/2032-286-0x0000000000270000-0x00000000002D0000-memory.dmp

              Filesize

              384KB

            • memory/2032-260-0x0000000140000000-0x0000000140192000-memory.dmp

              Filesize

              1.6MB

            • memory/2032-283-0x0000000140000000-0x0000000140192000-memory.dmp

              Filesize

              1.6MB

            • memory/2032-268-0x0000000000270000-0x00000000002D0000-memory.dmp

              Filesize

              384KB

            • memory/2088-161-0x00000000001E0000-0x0000000000240000-memory.dmp

              Filesize

              384KB

            • memory/2088-156-0x0000000140000000-0x000000014018E000-memory.dmp

              Filesize

              1.6MB

            • memory/2088-273-0x0000000140000000-0x000000014018E000-memory.dmp

              Filesize

              1.6MB

            • memory/2088-154-0x00000000001E0000-0x0000000000240000-memory.dmp

              Filesize

              384KB

            • memory/2232-0-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB

            • memory/2232-255-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB

            • memory/2232-139-0x0000000000400000-0x00000000005DB000-memory.dmp

              Filesize

              1.9MB

            • memory/2232-6-0x0000000000300000-0x0000000000367000-memory.dmp

              Filesize

              412KB

            • memory/2232-1-0x0000000000300000-0x0000000000367000-memory.dmp

              Filesize

              412KB

            • memory/2364-412-0x00000000005C0000-0x0000000000753000-memory.dmp

              Filesize

              1.6MB

            • memory/2364-409-0x0000000100000000-0x0000000100193000-memory.dmp

              Filesize

              1.6MB

            • memory/2592-324-0x0000000073C40000-0x000000007432E000-memory.dmp

              Filesize

              6.9MB

            • memory/2592-321-0x0000000000350000-0x00000000003B7000-memory.dmp

              Filesize

              412KB

            • memory/2592-342-0x0000000000350000-0x00000000003B7000-memory.dmp

              Filesize

              412KB

            • memory/2592-352-0x0000000073C40000-0x000000007432E000-memory.dmp

              Filesize

              6.9MB

            • memory/2592-334-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/2592-314-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/2720-34-0x0000000100000000-0x0000000100184000-memory.dmp

              Filesize

              1.5MB

            • memory/2720-153-0x0000000100000000-0x0000000100184000-memory.dmp

              Filesize

              1.5MB

            • memory/2808-270-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/2808-132-0x0000000000400000-0x0000000000589000-memory.dmp

              Filesize

              1.5MB

            • memory/2808-133-0x0000000000270000-0x00000000002D7000-memory.dmp

              Filesize

              412KB

            • memory/2808-138-0x0000000000270000-0x00000000002D7000-memory.dmp

              Filesize

              412KB

            • memory/2880-299-0x0000000000A60000-0x0000000000AC0000-memory.dmp

              Filesize

              384KB

            • memory/2880-311-0x0000000000A60000-0x0000000000AC0000-memory.dmp

              Filesize

              384KB

            • memory/2880-300-0x0000000140000000-0x000000014018E000-memory.dmp

              Filesize

              1.6MB

            • memory/2880-310-0x0000000140000000-0x000000014018E000-memory.dmp

              Filesize

              1.6MB

            • memory/2880-304-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

              Filesize

              9.9MB

            • memory/2880-309-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

              Filesize

              9.9MB

            • memory/2908-179-0x00000000008D0000-0x0000000000930000-memory.dmp

              Filesize

              384KB

            • memory/2908-274-0x0000000100000000-0x0000000100175000-memory.dmp

              Filesize

              1.5MB

            • memory/2908-180-0x00000000008D0000-0x0000000000930000-memory.dmp

              Filesize

              384KB

            • memory/2908-172-0x00000000008D0000-0x0000000000930000-memory.dmp

              Filesize

              384KB

            • memory/2908-173-0x0000000100000000-0x0000000100175000-memory.dmp

              Filesize

              1.5MB

            • memory/2964-162-0x0000000140000000-0x000000014017D000-memory.dmp

              Filesize

              1.5MB

            • memory/2964-92-0x00000000008C0000-0x0000000000920000-memory.dmp

              Filesize

              384KB

            • memory/2964-85-0x00000000008C0000-0x0000000000920000-memory.dmp

              Filesize

              384KB

            • memory/2964-79-0x0000000140000000-0x000000014017D000-memory.dmp

              Filesize

              1.5MB