47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc

Analysis

max time kernel
66s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
Size

1.8MB
MD5

3383eae351b7d7295566d55aaf11f6a4
SHA1

6ecb478df9a7fd7889e0a30b87044ae590b4ca35
SHA256

47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc
SHA512

d6a237e00aa63675772658d02f71af88d9dfc9eb6b346f6f7c61b104f890e8fc161812f36ad1a9f42f27fac8e26993317bd763c5e9561386f2cda4119630dc0e
SSDEEP

49152:OKJ0WR7AFPyyiSruXKpk3WFDL9zxnSd8HNUPCAaq8Wdo0:OKlBAFPydSS6W6X9lna8t4C7

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
464	Process not Found
2268	alg.exe
1968	aspnet_state.exe
688	mscorsvw.exe
2564	mscorsvw.exe
1284	mscorsvw.exe
868	mscorsvw.exe
1228	ehRecvr.exe
1152	ehsched.exe
1460	elevation_service.exe
1692	IEEtwCollector.exe
2620	dllhost.exe
2964	GROOVE.EXE
280	maintenanceservice.exe
284	OSE.EXE
2360	OSPPSVC.EXE
1896	mscorsvw.exe
1876	mscorsvw.exe
1508	mscorsvw.exe
2784	mscorsvw.exe

Loads dropped DLL 6 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\System32\alg.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6dea48721b98a6ad.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_et.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\GoogleUpdate.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_vi.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_tr.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_sr.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_te.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\GoogleUpdateOnDemand.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\GoogleUpdateCore.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_mr.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_ur.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_ro.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_de.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\GoogleUpdateComRegisterShell64.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_hr.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_ml.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_ar.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_da.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_pt-BR.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_id.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_kn.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_ru.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{D3BC00D1-BE1D-4052-8093-8D7CFEE44A49}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_bn.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM42AB.tmp\goopdateres_ca.dll	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	alg.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F5BCBB07-AFAA-4944-BA43-7028E9C8934A}.crmlog	dllhost.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F5BCBB07-AFAA-4944-BA43-7028E9C8934A}.crmlog	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	ehRec.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2068	47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
Token: SeShutdownPrivilege	1284	mscorsvw.exe
Token: SeShutdownPrivilege	868	mscorsvw.exe
Token: 33	1292	EhTray.exe
Token: SeIncBasePriorityPrivilege	1292	EhTray.exe
Token: SeDebugPrivilege	1976	ehRec.exe
Token: SeShutdownPrivilege	868	mscorsvw.exe
Token: SeShutdownPrivilege	1284	mscorsvw.exe
Token: SeShutdownPrivilege	868	mscorsvw.exe
Token: SeShutdownPrivilege	1284	mscorsvw.exe
Token: SeShutdownPrivilege	868	mscorsvw.exe
Token: SeShutdownPrivilege	1284	mscorsvw.exe
Token: 33	1292	EhTray.exe
Token: SeIncBasePriorityPrivilege	1292	EhTray.exe
Token: SeDebugPrivilege	2268	alg.exe
Token: SeShutdownPrivilege	868	mscorsvw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1292	EhTray.exe
1292	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1292	EhTray.exe
1292	EhTray.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1896	868	mscorsvw.exe	45
PID 868 wrote to memory of 1896	868	mscorsvw.exe	45
PID 868 wrote to memory of 1896	868	mscorsvw.exe	45
PID 868 wrote to memory of 1876	868	mscorsvw.exe	48
PID 868 wrote to memory of 1876	868	mscorsvw.exe	48
PID 868 wrote to memory of 1876	868	mscorsvw.exe	48
PID 868 wrote to memory of 1508	868	mscorsvw.exe	49
PID 868 wrote to memory of 1508	868	mscorsvw.exe	49
PID 868 wrote to memory of 1508	868	mscorsvw.exe	49
PID 1284 wrote to memory of 2784	1284	mscorsvw.exe	50
PID 1284 wrote to memory of 2784	1284	mscorsvw.exe	50
PID 1284 wrote to memory of 2784	1284	mscorsvw.exe	50
PID 1284 wrote to memory of 2784	1284	mscorsvw.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe
"C:\Users\Admin\AppData\Local\Temp\47d044be2951dffe44c13145da96ef1f035d807e5a3b28b9919166969b9302dc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:1968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:688

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 250 -NGENProcess 1f8 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  PID:2464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1e4 -NGENProcess 240 -Pipe 1f8 -Comment "NGen Worker Process"
  2⤵
  PID:1892

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1508

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1228

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:1152

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1292

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1460

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2620

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:280

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:284

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2360

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:1972

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2240

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1028

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:2456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2288

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:948

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1984

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2792

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
PID:2020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:1088
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2444714103-3190537498-3629098939-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2444714103-3190537498-3629098939-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:1632
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
1.3MB

MD5
039c5d52f0f872c545b45e31961c2c63

SHA1
bc3352fed77c1990da362c6bcaea6f98e2420321

SHA256
8d0586017c7cfba3a4b12151149f646f2afe509a4a57cdeb2e5c0f23a619fa45

SHA512
47e4911af7dd2558ce378dc15b2b3bcd64a88885cec92674e6a43fe6c1aeeb513da35780bd24e40506ccb268821dd8c50b1e71e1ca62d9bfe5d8e407780c79ed

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.2MB

MD5
28d8a6a722d9f99a96affad4191a3bd2

SHA1
618be95dbf311b3376b8337c1d5ad2b8a2f7e645

SHA256
85bffe9e72e3dec25ffde0674c7f5081a68fed10e162d397b0086dfe80400b11

SHA512
39be5bf7c44d00cba21521e16efad4fdf83399cc323d21e65eabde70a99691a581706bdcac76688219257980bc93571263f96f02e953e3805f4c51c08f89dd4e

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
1.3MB

MD5
4cd871579400ff8b03d2307f8122da98

SHA1
5bfbe2bdf4e4ff6da8a3ec81417a62533cb22dda

SHA256
dfea83c46c99e2e29294cc67b687c93c1a53296f0cb2cef4b2cb56740a75b6be

SHA512
bfbe8c35f74ac53d4f2c71a70bf04f04043e42e47fca1e1f6a65ab49cfd392e12735dd377e65d79a821f5b693504bebd625446e69b0ba26d95b8aa3fd8debbe9

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
1.7MB

MD5
08c9ab4e614bcdbb94105fb00043ac67

SHA1
f86415aa537529e67a156ab0e7556baf9b79982d

SHA256
7c20f19b85e655f0e02d754e9ce6e3cc766d5d9b3ef0704c1e8e5880b33d2762

SHA512
4189c300508c1074a13ffe684323e440df4671ed1553ddc7a4e824e3c432c9a3a378cffd47720cfbcf87a65a2c10b11fec9e5e042265af1db4f58963d1a3e8f4

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
640KB

MD5
230c1d48e320754c7365a36d1193a3be

SHA1
92a6bff13be253f8feaabaa49a9ef3a1da5e2710

SHA256
d7aa343835fbdcb711b17b341a254a98ff9523ef2e0091e89235d89a73760535

SHA512
18fca8cce5b34f18de00655571664880c4daefaad9006059a7bb6c16d0edb049634cd4ab30eb95609fd2557d31f1e6994a1a6ef2e03282675ccedce63563eed7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
707KB

MD5
3414aa57ecdf22a099c465410f9a6893

SHA1
76e47d1c26fa09010379a2af1274651f320e6fb8

SHA256
8e593a1b47db0c092f0cff34dd555f9834b5d35fe03c1e02bd1cfc74effceb90

SHA512
ac4c16929985e858d5248c3eba4e3b1c486b9329818c5192615faddc7c1218917a1a5b7ab744867bd935b4e8edd431158bc714a8a92c800598cc9934736bff1f

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
190KB

MD5
fab617a5d74d7253f7d7cbb50023e902

SHA1
2274e38c3b4e174b97a0ce734aca83daba2ce34c

SHA256
ed1a7485d78ef3424bb5a84d9968594c3466c6d67034543e38284ed62696f083

SHA512
e5b81708cd3bd56c290ec3089c862322c915d781a058b3293043539c1fdce6588d42a85facd774e241db0ff9b0de9aec2c58986a9b9d475abc865ba63a94719e

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
2e95e95b7bcc9fe5b3bf8def0f943ab1

SHA1
a101f750b03983d0dc2d356ae6433e10053c0253

SHA256
00fd5b86f0df69f4ac90a42bd292240d6ee01591206b4a508679c1f26e7c2cfc

SHA512
1f0d3fba113e7be5ea7730b598442c990ee7dc032c35948bd331492d3d6a51876ba70272b45f4464f750ab7d506830eda64dcbda251fde209c920d7ae55b38c3

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
d0d1f91789402b0abccc55933b304e04

SHA1
81d04b9c58b4ef06529bf6e3f5cd5b28f7f9d3f8

SHA256
f1046ed5b8ae44352d50e0c950ebbc7630eca28a6d981632c4761d26e55f00e1

SHA512
1d67ced70da8e6f37e13465042749e973301e4201ecd6addf3316556572528cdb0519778d537af7acc3bfefa68948c57f881423683280302f305019f473b9006

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
c117ae5561f57177d20428d392b70415

SHA1
fa3313b419aa3a7fa823a14936c30c27282c596d

SHA256
c343efd884a5ead66636a86bac3bdd23a21747c394505843fb8187a785634d46

SHA512
4b2e7f3134f34aadd5580453218b13ec81599c52a443a54f4053a070444ceb5aeec2c7d7980bb052b50c5ce1fa9f1c09751e669af9aee19ca6f88e60aca68191

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
7f6626030ce42c9d3a60d83c37e9c738

SHA1
4414cb1537387f15f3bcc32e3c70e1bbd79a582c

SHA256
301013dbccfafc06921f7d689024b6098acee64b83af6bd27eeade1a52e2010e

SHA512
72566f00fb89a32dbfd9232d93ee1f507c8e3f488c4ced3cad2bedacebd86145d963d0cbda4196fe22a6bb06712778d991965131e4784bc9ec96694d209ed169

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
91628533a49d4a6d3cd6b733999541ba

SHA1
ac8da95cd18d0507df3c8ab9a79b65bd7536bb42

SHA256
8785acd69682d3bb7b56a8d7d49a21983002b63d7d441443019bd6840b2cacf0

SHA512
082acad53fd6450822123f22502201a7c8befb9e1955f9ad2cae77501c316555edefeaf5dd7f0fae44ab0194017add082ce73a137a18d2e983d328459aa45408

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
473KB

MD5
616bd289a3710328c110ca624d17ef9c

SHA1
25c559a2a12f4490de85ddbb251195c30b08091c

SHA256
bbfb7bb4093895b4baa6c3e0378cd7066b5e2b92ee58f1113d47f38085214344

SHA512
0986bcba03e0fc55d8857967729e15d16ba1fc8ca117795ac350107b882a8d620e0592f959d158592034df77f11fda19a61101652e62cba0bbbdd018a1fca473

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.0MB

MD5
adc658b20041aedae984f42ce9a2c18f

SHA1
1b2d37a509ca171989be4e2c5c41005a6bbbfd10

SHA256
6be80a203da4dd8498ba9ee86a40fba22c254e44e9649f7a0f59df9ba374e227

SHA512
fae2ed407d61c6b509c2623bafc09cb69b82ad6bdc79547bf0a6ad7aa21daff50624d53b6fe889a7b14d2e29758454e452037395a2c014ab2dc6096c808eef87

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
608366821eb04dbb057112817860a217

SHA1
3de7a7b210bdbe81bc2073ff20d57c13f45f84b2

SHA256
d2024f40b5d4d0165c6bd8c17a616c32a242c4d631d30888f372e362ee7b61f8

SHA512
14918e2a3f9024733abf523fb7aa1606fea28983f880c4c8872994555730c308b72b75b297aa970433166c1b135571a9d7a2a7e2602223fc3b7571a65fc478bf

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
442b78b2bb4126f6443b319a480f138a

SHA1
afb6b195a87af922ae3efc51b5a86f0b42e27e5e

SHA256
68ebbeabc6deacff43efab38e924f1511b444f6ec32e0163f9a2a44674980456

SHA512
e26b9b1e6cdc5ffe33c13fe4dff7e38b48fdbf72c6f2b014c9da68e68ee96e21a370e25deb05df60850e48f055fd5440c323e441082ab16e9a4b9ab39ec87794

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
c75209baa4a1bfccc6945816e026f8db

SHA1
69a5b7b1d15bfb9e465bab9b1976d56c60fef60b

SHA256
c36ea9368b7a65d2559fd3887d22cd535c653dacab43560d15381a72c8b35a73

SHA512
ad374f75ac13100427707b89ebcaa2f4b46b7ec42ffa4001eb3c2ff8a5807f22cbcd7cd1ddceb0e71eef24b393043c21384a323f85b8bf9781eb3fce7437a86f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.2MB

MD5
17bd2e41eebf0487cea4de452d9da19e

SHA1
7b133fc4619ed73d3600739b8923d6a2b13006ee

SHA256
c67a7b218db4e64da0671fb87ba07473d535cb1e01ba3e409b18db2c87518b0f

SHA512
4887aa182c8df1a16409619697be24aaff41be2d96a39dd9ebf6fcbe039dae80401fceff5a9a301e0e7177cd8e1fac526603660cf0d5a1bc8b11b8a2351eaa8d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
739KB

MD5
ef438771eda6a6e0086dbcc7a5674f26

SHA1
a03caee75f2af9cd0b050063d89ee709a8653fa8

SHA256
dcabd6b728969f79d22d23aea1bf94fc712ad0a74d2c67531ac86939ba63ad8b

SHA512
c64aba18cc5ffb8e7965158fe47d4656d8495daf64a4aa47d8b729c1417ef8e8af6cdf6fd124c0b96c74086b0674841ff98c7dbc8ebf469d6916980bed38bf72

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
141KB

MD5
2838a4288e3b7295fc6556349c7a8de0

SHA1
8a7e48d179116ba0a72d5f1f1577a76a2f472fe0

SHA256
8a40a74eb540caa8234366bd39ffc73dec2ae3df9d8aa63d411eabf1b4492028

SHA512
2d76d381da9a2af6d2f6863ba28363bedcdb94766fb51371fa0a6fe7d69e0113fc4ad29a1e7fdd7ba654b02c3c73bf2a63f5a7d5a74f072c5568773fc3591432

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
64KB

MD5
9edbad8da86e040a666199904b76aea7

SHA1
a9aa1ed1d4dade64c301f84ed053542cb620bf4d

SHA256
59aab0da98017617555d293a8a084e610bd4643ae7f0f39ab8fceee9f829272c

SHA512
e21c35aeb82d83fb967f562b28dcc3aaf8db0a5452647325aa4cc7ffb40538824718effad75cdafa9ed983e49173090ed3788bd90833c7522690ee88a92bad23

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
6fcd1a17ae1e79a7f65bc835cb137739

SHA1
a8adbdf609b599e7780043b5cb6b7408358eb366

SHA256
a420ce116f3ba2f6c10d508b6a52c9e40de0ec2dc77413d0040d73c533ff0c0c

SHA512
0ffa4bb23bfca108d3dee52d60aa95dab114d0e127c62dc964caea218a2f28a5385379532b9707b160ed3c2b67388bdea96c149e30f43b782eae214de75f0738

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.2MB

MD5
6a7393a0ba1781afdd33db0c45e0f76d

SHA1
19c25f187e6d2d273d25b719beff4306f2a773d8

SHA256
84ce4180ce42e8b5bfd8d1faf137f93464b0e2a4a34ea37750f4d0d5c180024c

SHA512
51309eb9eaf42aadc934af05f268ee337a3f12f22b35bd12df4f500d8a0e04795f1901a5573e5544224f8364c6a164552c2f2c051a217bc8b32a2006b6f364f8

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
fc4f63064ad5343d4e03347c3b503e5e

SHA1
62e34c565841ca99d8ceaf30b4c9ac42cca2ce38

SHA256
4a705d956f769d0982f7390b5dc66eb570d64089cd4b526c573c11973b95b62f

SHA512
d9c58a7a4c4603470d698ee8ac60398e0b323aa534dd8025f6ff47b262d39ffe2ae19000a84b3fb8f3785d82a2b28c424dbfe7da5f53ab04438f96c2a258aa53

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
a29c10bb0959010618c8c8a1e68ad644

SHA1
b1d3ac26dc6306e18307ff38b3409fb931c6e5db

SHA256
72e1fb3f23d0b8e02d3fe86492228644f3d8fdb3abd614abad91a343d332b044

SHA512
63c81308bb503dcb95773fb5fe716305bd4d3ee4b4cab5243ccf65f3b4ebdd47eccc6139d5a585e7812821c1ecf52bf7d606525d66079e968e9a922019f86f0e

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
203KB

MD5
819c1612c6cda8b453ee402f3c41df84

SHA1
ea7deec6d8c33eb47f6cc61bd6bb6b6fff8f9f29

SHA256
c829aae492850708cfd5f065a5070a80d580508f973577a190e061307b71493e

SHA512
3a53fd4afa2ddb2523d0a0d8ffd5aca8088e11031b6714f1587aef2b5c144b0aa0da46de2756a209f5d131ff03344d8ddf0173dcccb2bd00e669fd6094719e71

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
3a72e3899a28d44de88bf3cfe4563253

SHA1
e5540c60b2538a2ab1aa3b15299ee1cdbb969d4b

SHA256
e0623d4a57509154ce2479292da086179d9d9905296a50037dc2a701ee396841

SHA512
871760cd1ccc3b89c7c6841ec045d5848ccfc66a03390adfd9e709c095b5e6a65842c39e68ff0b914e9640393fbc218e92e3378398a2a2872972ca1c65b577e5

Download Submit
C:\Windows\System32\Locator.exe

Filesize
384KB

MD5
dc47a5dd17d9998d11cad380f12b0ac0

SHA1
8e867d3067dcdf34d0b9e298e18faa8bbd906062

SHA256
1159ed548d0aea6832bc8d9ff0fa95283de43cfebaa406c9cc37b6218d6efed5

SHA512
b378aba03082bb0bf1728a52f46ddd17d23a22e542faa898bef73ad0e7915b2c8c03853185e6f337f4e4e1e146c60b3aa863ec49bfea8277ddba703ff0ad02d7

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
d699cbc02aaa03d2bb5afaf2b0826036

SHA1
b279de1b483fad103a705652434d48d333b2ca28

SHA256
320a8c2382045595411fe36fefd196401cbb9ec4aebef266d93d1e198072b844

SHA512
df3080589223acb0068d06f004cb5e975bda3b6ef48690e56bcae43846bb75e02a9114461d6cde091c174bb21693c3561d1d177472f05ec534fdf46555b1455f

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
1.7MB

MD5
36532f9c04921feada71b409b459df50

SHA1
207f67e86ddbff345d319d06479d14316de06c92

SHA256
7ff670f629fdd83b524be5b850954d2190889e1fc470bd71a53422ed3495db3a

SHA512
6e7582acfec1d7b1363197fbd7f66fdb57266c5e942b6884cce0e26fd1e52d13b5d544ef6733ddc9ce300148fa39cee284b2b507db388274d4999290322c3b15

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
1de7f87bd2ff950f7d8c2ff6b7f23345

SHA1
bfa1303abede343f10eac2b024d3f279c7e2bb06

SHA256
4e58c586252fe3fa594dc0e03fc8e81114f470893316fa7b7d1b8600b73f93cd

SHA512
51357b928c865ef045b49591f67b02604f479722f94e22ac793cc873e50ba46c5c2ae55b0892000a5b91a2c70392a735b9a43a01fb2da3a2a480852f00766b1a

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
5KB

MD5
fb8bfde65f8e1e86e1fb26c3df386ee7

SHA1
b9b4e42bc8ddfa76f1566658192262c0fcdecda2

SHA256
9a30ea3f2a84d98cb40f511bbed684ce8e4c850e3503de83c13f83aca53b49ab

SHA512
e7dc71683b5cad0124947416f75811cbc8467150a4050b0b5390f041b5e69174d9cfc5aa71375291caf099338dea9fb4b8a7ce871f623ae61dd1901812e46bd8

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
e21c41f55f8cd9929d6760326bdf249b

SHA1
6a1992ac0884d418b2a44a8ddcb7d793851dfa5f

SHA256
4b7807bed0dbb2c9166c92253df93495db5fdb8abf4191a444fd6cf8f057e02c

SHA512
5aba7938fd26c0020408dd96b286409c5d7c9edbed3f92d230095ec10e9a0993ce68c356e4a12a4be1a6d338e5cb994379d7539073d07dbc3619ae31000a0fc3

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
698KB

MD5
249f4292f4197120f8bc6fbcbc7a3df2

SHA1
889e81f7fe0d1ff46f1e0a638bbed2936eaa14f3

SHA256
37230df7a8255b67a792a427d3dde841b86016158df3493e2471078e7136e93e

SHA512
83dcaf0af8c0d1430fbae5c10b7ca02a134480f5455d056ce3c31ffccb001b444e85be3e56f87a41830512b0eaa8da02e13a6e655b6ee570a83d1422ec660f17

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.7MB

MD5
d7b25c4a279e7c8b52d347305a0b09e2

SHA1
1b772a7932680510321148d1a6cc429bfe0f473e

SHA256
bd82019946dba6b3b39ec668f2d2a29a7595aa535c2210e3829cb051b6944278

SHA512
61987faf6b57756ee81b206fb7111fd2dd6b4129a15a19a26e2b06298cb7a3b2069dab200466ef3c1b53694eb4fb0c9730ec2c3bc1405ed9d67fd13e29796e3b

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
df9db14e5b611da8ca78a7529a3112fd

SHA1
7ed73b7178a103588b468bde3c5fad25ad04a3e6

SHA256
a11dd7ade20be180e00a57d49c3750702a51876764f2b36d135090481570f1da

SHA512
e146bdd591697fc9167f016bbcebac54e17168211ae13ecc9836ef1f071907b1c9674fa78d2018e255f12d7b079070653676bb8ee39dfba06e47f0e596673b1e

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
1.2MB

MD5
750c0d16aab49b96f7fea3a6ee11c340

SHA1
a24f562c53277ac573553ac66362ce4a922a3e59

SHA256
286446400e5d211403233329e672fc8004a7d83b0266537ec1c9461bcd5b93fb

SHA512
4782ddf1fc1d57f6fe1ef4c284af104d4dbce0f51d60b6eca2d1a34ae76d8d03f2ed3701e98f0c708ea4daa7e4cfb62e4d8f594f8ea0d9a5c0cec35d668c4e5d

Download Submit
C:\Windows\ehome\ehRecvr.exe

Filesize
1.2MB

MD5
7dcc8acbc7ee2129d7aa80827f135a1f

SHA1
1713aee1cd365d45e59d944e8b582dd82482897e

SHA256
8eecae91d88b2a38b823bc30f30146d42d62d807bc0bc24b96417e7bc1580e85

SHA512
fa6646fc827413691eb95a4eeb73db0b6e3e0cf5e29626bddee72ddd4b8a2fabaa937a7147705b1fc0c1418bb8c971a8f04bb9b07797a5be4e3bae24181ee7f7

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
29KB

MD5
a353b638dd5a1c09b9f63481e47d5833

SHA1
da74c2bf5cb3de81f9625936d9f8f05871a0d594

SHA256
fbf70555f6ebd81ede473864247a17b08d8e2ace46f13b1093088f6d1b77fdc7

SHA512
06a3593ffea71854d4b0c63803a3b06e737d627ffb30dd41d345c6a2245c57c706b26680f09ce9d6b60f14f397b66a6c9036c4dbec931825ad42e77d4b349452

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
58KB

MD5
eb7b5b9bc6aa8bc45b83822e6ac2be56

SHA1
5c10df276b133dd5e0e3f170d99847687a69adcb

SHA256
31ffb89872acb577ec384b8c142e15da46a45226124fb394118903811fa7a8cb

SHA512
06f0da26c9730bd22953925f1e94c61b2dc827044100777dc8f2ca616ef89211da52de3b79db580f0647ce37c5202f1220d1d9d613593ebb7fa2267a4fd04376

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
493b45a54c5bcd677e6b8350f279dc6f

SHA1
8b51ac6f66c37e072ca0010ab6f467dbc749e3c8

SHA256
06e8f8db9048b35b8ba3153ea80e2dbefa18d199cedc7354db94dd2c43403f55

SHA512
4c0a2db6498753a35c373b7557a37e15a55ed6f09c6a801fbe1049f43a52eab88d60a18544f8e748b5ab1f044ba523c98ee47cd20868251cf9a65e009e8d9593

Download Submit
C:\Windows\system32\IEEtwCollector.exe

Filesize
1.3MB

MD5
ef6ed5828b0aaa0d06f4b7d00c225c5f

SHA1
1b6f26ee046c04b91b90cec0fb9c49fe7c8f62c6

SHA256
fbe9ccda1cf48df3fd031cef5dd8904c249235a5bb8afae9bf7670f4b7ab3034

SHA512
e8a393c87a51aa529402fa6fb66bafb44ee24ed18ffa7c8c6a040ec3603fd975e2c37fec7c3529ca26e9738bde961131a779a75b5c6bbea0de626e99b20ab980

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
53b0d7437efb5004d678e5fafd3a672c

SHA1
d6fbd57d9f09de9974d389bf26e971b7a4711791

SHA256
1ef732f6ce845f39e706872da8d7780784172d54c81358cc954d77fd6883c51f

SHA512
9e1b6e1668731e9412a0d7c3bd054f7ae61ddf39ea3c16a4156d824664d9c9e7e982bfa57c83bcfd250138cbad2d935344db73f8d32d4a9c3f8622a18ea7f334

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
813KB

MD5
63c572bfba8d7e131d97e979b29e0ae7

SHA1
5d886953c3f68a7e7b8dab1a981daa8eb6250fd4

SHA256
d534ab27ab12fdf5be0cd128edbe5c24b5a38f1c03d0391164b4baefdf6c299d

SHA512
072bd2fac37fb07c1d37d77622ae0231f978f837c176c359b8bc94f894c641e47f60a6d56c6ca9632bb918c2be079d25af71668e91d7577652278955ece7d6b0

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
64KB

MD5
b4643f0ea20c08b57c61ab83169dc9c0

SHA1
66401a31dab1778754880638bfe21f939f0e0fd0

SHA256
851d76253bbbaa458d65bb98e69b12ec7456b15efc9580b3fc581080f109f528

SHA512
9f53ef23855b4db5a5b5b56812c852144c672b34cab0a75b0c139526b003b1127c08944fc17d0da61efe5158773b66c399c75b16c990e58f4f2fc2b46ec8c4da

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
ca379077a80a55cf5e1bc170d8aacd31

SHA1
5db0db07ec0942510ac29230308455ce7f08f8c3

SHA256
f5e4f187d985a7d551ba7b764507032510f4e24dcd4f3ccedf4b4d2cdf54ed41

SHA512
dc2f15f7db7b67c5d04570ee59d64387574456fd3d3f32832711de0dad9ee9708f058a8b6a8ff45138700401e8714b7a6516e8fcad7b7f51eaba8be995584ecd

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
736KB

MD5
7bd938e1fe544fbb76500af22d14e081

SHA1
27d94dfefe172a01dd96dcb56434ccd2833e1af8

SHA256
adc240568f5ea4b69bf0dfa662282ef708776de140c2aac1d1d03dc63e78fe1a

SHA512
3863c2492689fad657c3e9b6586e08d6e7f265a3c5dff02772a1ebdae71d8fb1dc54e1dd34c722d27e588c67c018d9c13a86e3122b5c6ea47775bfc3b69e0d8f

Download Submit
\Windows\System32\dllhost.exe

Filesize
1003KB

MD5
6ff91ce2a8bdea2308e3693787bc3c3d

SHA1
3544491cb2361f14b8d8dd4328e52d29da74ecea

SHA256
658578345d2ef2cdadd9380a5eef5936a0ee182bf9fff61358b752c85cbda861

SHA512
8bdc5593f6f345084e20013ce39fa7fff71258a8b23161becab5fb5ebf6e6d0056eaa8cced3eca5a8807a06c384d1c9c1208833aad5a418164f7f9456a9d1c79

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.1MB

MD5
d2282a497e42eae4044eb07c524b5d4f

SHA1
5907f2755578484a1a5f1ed95ef2b2e518b1438d

SHA256
c2dd7bbd7d3cb6d957eb32e77135dc35140e3f279bfb789a6265fc9c53d86205

SHA512
6f07e66d2ae55a2e474f8ba665d4477d744787a53c3658109dd948b080d090dfd758813767bee841f9c00195996896d7b341bd0e65346c0ff425138adbca1664

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
cdfdd304e922d41ac453f217085bfd01

SHA1
3a112eea8625dde60ee15ec906a5db50d5e4f5a4

SHA256
8a5880d92aa46c1d3098746663129c2dcc37fe021505c911f728a15acf5f4925

SHA512
a1b21d04ce50390869f03010dab252daa972466ea4db92d6ed1c611f8ed9943ebf798139d3a82fbbd56114ea4171522e69526d4f32675db3fba9c022034ad270

Download Submit
\Windows\System32\msiexec.exe

Filesize
945KB

MD5
f11c595553c64bac3b86c78fd0b9c167

SHA1
d2c4eb5b394a257802d2b4dbb94d92106a443947

SHA256
df10e702c4ad8306b6ee3aefeec7ad07e93adc740016fed840aea7f667485ccc

SHA512
8abe8e02399524c20858992a7af8d1e7766e6589cf888558ff0c9e3ed1717765dc5dc7ae52ce8951a1acbafade016f93771a4c194d30d8469824bf668a4ecde7

Download Submit
\Windows\System32\msiexec.exe

Filesize
704KB

MD5
ec38ab939a97880943b73432c29a4b2e

SHA1
2cb6735d318690eebb2c5bb883630f4021a5bbdb

SHA256
87391db71c0f1ceb95454ebd1850178dd5dc89e828fbcd2692ea9c31d102f213

SHA512
db3d5b0068d03196948a62aeff855c638e30ad0a82a2a8f52d42f24c6cbdbfa5a4f8889caf423338766145db850fd6f6aaa7c52f8ff7498fa40c45b5faa8da79

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
964e4b5166dbb80a56e81fb1d798ac6b

SHA1
37f1e39e6044143dcf57acc7c2bc3a96f1d0ca5e

SHA256
fee77f774ad7dd0a9ed5c6e6532abd16c8224603d38f50978678af90b29ebec5

SHA512
dd312b04ab0bc1425bf1562f97460649514454b31ecb2fcb464f3d09e23033382b922004c1146be6d159672da8ad0cda2745a02a140c04e9d3e9fc7b2947920a

Download Submit
\Windows\System32\wbengine.exe

Filesize
1.1MB

MD5
296ce046c073413307e2cbf69fcecfbd

SHA1
1ce2d73ea01abd5e016d42694c61e878338acfca

SHA256
d35cbc4178fc7875c85695b1cd2fd6b4576f251b840b73ea33078e1a947327a2

SHA512
2c8f8c484cd495ef590902760d818fc6be798ec26d0e60a0b9f8f840da68fd9618fcce04b285aca0652cf9319449e28faa99e7e75fff78b5830dd78422115e44

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
34KB

MD5
9fb9d553a255c0859df766c9abe02a1f

SHA1
43ccb5a7d6d8630d6414ee176a4372e92fd05bd7

SHA256
fbfef47491094d325c1dd34f9e2dd2292c9c5583c930bbbc3c9e4f4d56198b78

SHA512
e889311b07787fdb0845cff4cc0be74f081853cf03af88e15d59450de768a5beb018c20a24a2d9a90cdd2accc3490d5dd3b89e5c75bcb8f606b647fc6732750a

Download Submit
\Windows\ehome\ehsched.exe

Filesize
53KB

MD5
7d8e7bdd6d5b4603e4dfce57286706ce

SHA1
86d2560bff13d2a759d50287f154afab0554a36e

SHA256
5994d404669da49d3e2d4e023cca884536d2345eba1e321cd9972bd41d24e79a

SHA512
fd6a9c8da84203303e989797bb7e25276c05c768ae0f51852791ff3235ebfc5e40be83447256561067990a8e7fae97c236bf3abae1b08388629dd2c5d81ff47a

Download Submit
memory/280-358-0x0000000001000000-0x0000000001060000-memory.dmp

Filesize
384KB

Download
memory/280-357-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/280-352-0x0000000001000000-0x0000000001060000-memory.dmp

Filesize
384KB

Download
memory/280-345-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/284-370-0x0000000000450000-0x00000000004B7000-memory.dmp

Filesize
412KB

Download
memory/284-363-0x000000002E000000-0x000000002E1F4000-memory.dmp

Filesize
2.0MB

Download
memory/284-565-0x000000002E000000-0x000000002E1F4000-memory.dmp

Filesize
2.0MB

Download
memory/688-106-0x0000000010000000-0x00000000101DE000-memory.dmp

Filesize
1.9MB

Download
memory/688-141-0x0000000010000000-0x00000000101DE000-memory.dmp

Filesize
1.9MB

Download
memory/688-107-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/688-112-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/868-164-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/868-170-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/868-314-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1152-204-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1152-569-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/1152-570-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1152-342-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/1152-195-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/1228-328-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1228-206-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/1228-189-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/1228-351-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/1228-181-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/1228-182-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1284-218-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/1284-146-0x0000000000BB0000-0x0000000000C17000-memory.dmp

Filesize
412KB

Download
memory/1284-145-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/1284-151-0x0000000000BB0000-0x0000000000C17000-memory.dmp

Filesize
412KB

Download
memory/1460-360-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1460-211-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1460-220-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/1692-316-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1692-311-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/1692-574-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/1692-573-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1968-95-0x0000000000320000-0x0000000000380000-memory.dmp

Filesize
384KB

Download
memory/1968-92-0x0000000140000000-0x00000001401DC000-memory.dmp

Filesize
1.9MB

Download
memory/1968-180-0x0000000140000000-0x00000001401DC000-memory.dmp

Filesize
1.9MB

Download
memory/1968-102-0x0000000000320000-0x0000000000380000-memory.dmp

Filesize
384KB

Download
memory/1976-369-0x000007FEF4970000-0x000007FEF530D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-564-0x000007FEF4970000-0x000007FEF530D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-306-0x000007FEF4970000-0x000007FEF530D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-546-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/1976-347-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/1976-373-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/1976-307-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/1976-308-0x000007FEF4970000-0x000007FEF530D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-560-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/2068-304-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2068-1-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2068-7-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2068-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2068-144-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2268-162-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2268-38-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2268-17-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2268-16-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2360-427-0x0000000074668000-0x000000007467D000-memory.dmp

Filesize
84KB

Download
memory/2360-566-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2360-391-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2360-388-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download
memory/2360-380-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2564-156-0x0000000010000000-0x00000000101E6000-memory.dmp

Filesize
1.9MB

Download
memory/2564-130-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/2564-123-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/2564-122-0x0000000010000000-0x00000000101E6000-memory.dmp

Filesize
1.9MB

Download
memory/2620-395-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2620-322-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2620-319-0x0000000100000000-0x00000001001D4000-memory.dmp

Filesize
1.8MB

Download
memory/2620-387-0x0000000100000000-0x00000001001D4000-memory.dmp

Filesize
1.8MB

Download
memory/2964-423-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2964-330-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2964-337-0x0000000000300000-0x0000000000367000-memory.dmp

Filesize
412KB

Download