Overview

overview

7

Static

static

3

a56f79bee5...f1.exe

windows7-x64

7

a56f79bee5...f1.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-02-2024 19:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a56f79bee5a8f027d60ebe261c3724f1b6bcf400b0524e342a78a96bd6952df1.exe

  • Size

    1.3MB

  • MD5

    43d79758c4e559fb06bcd479224964d4

  • SHA1

    b79894f6816e2cf20a34c69a2e58eddefce870ba

  • SHA256

    a56f79bee5a8f027d60ebe261c3724f1b6bcf400b0524e342a78a96bd6952df1

  • SHA512

    e8462af270091a86f62cb28950c41dfe0c03dd79fa96c8c80eb345dcd8be1434becc2eace541011037542cdfefd53568f906d3db6b07792804d4cc0b9f3a3f3a

  • SSDEEP

    24576:8A9B9Cks7WE9F5pwg8zmdqQjC60jiHkU:8g9Cks7R9L58UqFJjskU

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 36 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 34 IoCs
  • Modifies data under HKEY_USERS 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a56f79bee5a8f027d60ebe261c3724f1b6bcf400b0524e342a78a96bd6952df1.exe
    "C:\Users\Admin\AppData\Local\Temp\a56f79bee5a8f027d60ebe261c3724f1b6bcf400b0524e342a78a96bd6952df1.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2012
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1576
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2096
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2732
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2540
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d8 -NGENProcess 1e0 -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 24c -NGENProcess 234 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 25c -NGENProcess 248 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1548
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 264 -NGENProcess 240 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2352
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 24c -NGENProcess 26c -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2556
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 270 -NGENProcess 240 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1944
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 120 -NGENProcess 248 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1436
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2164
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1108
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2824
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:444
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:1208
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2200
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1904
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1632
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:1440
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1068
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2460
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1596
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2580
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3012
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2436
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:1960
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:2100
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:1572
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:2664
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2712
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2480
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:1976
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1776
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-452311807-3713411997-1028535425-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-452311807-3713411997-1028535425-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1892
    • C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
      2⤵
        PID:2724
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2040

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
      Filesize

      704KB

      MD5

      6b7eff47662a2cc85f7febb077c7c5a9

      SHA1

      8674d9776dfdfe90c1c179f21e36a221ee014cbb

      SHA256

      53cac811f7278b1c455ca1ccbab7e353b365348d3adf134c8f1b943b100c2ff8

      SHA512

      a4051d4d1fe1b35e4a5456d7de690a8e6d1a8377055c24cf5bf63808b3c82c4b523128c17defc96abb76c5cfaa9e81f7eff29e1f1a60ed64061b40c5093202e2

      Download Submit

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
      Filesize

      1.1MB

      MD5

      c07599d147bd2a07e731407b86029b6d

      SHA1

      f54ad8762f3b8fdc2c5327a9171787c37be56601

      SHA256

      c9ff6ede5bc8dc49dc8134ec82a0ae0bed8d45669aaaf079d070c80e560c7a6f

      SHA512

      47776c627db8ffff66e121f2c3408ecc6821d63b46d36a8b3947cade5e2d36eab262b78e2f3295f675536ad5f2e6c68d325fe348e4fc53354e78b7869b0c86d6

      Download Submit

    • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
      Filesize

      1.1MB

      MD5

      ebcb8d252a2686506f3d7927af4c0eb3

      SHA1

      80b817733a2229f7ea6686fe73f47b98f3137a05

      SHA256

      ca3bea714cee850ca6079dd2256b1d4f05bcae06156aa0f54bb93b95ac992e1e

      SHA512

      9e5ff74affae1543d9dff1e6fcf3b0b7d8fa05c64cc0a45c10546dd01997017ee82c9e15ca64c86ecd8bf013ffaad80d8158875618fdd1564db6ff3f6f258f06

      Download Submit

    • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
      Filesize

      320KB

      MD5

      c5d91257326408fb288dd5c0bc18ea00

      SHA1

      e824e3f906cef96068c5ebf18d859577fd27af24

      SHA256

      6d1de6d0993e07e38e6e75ae4633c9e47039a4ffc9462d2551d4d1a5b60228a6

      SHA512

      299c80d6f1cf2986c94afca743ec81cf11093747762736b32ba5f8c153c53fccbecd1bc88710a145f7c1bf50c08c4365f91259fc71ccae8a3a18bfab2e288590

      Download Submit

    • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
      Filesize

      1.3MB

      MD5

      281fc3cfce3ca6581efe54eb892aee97

      SHA1

      4f59df7920bf4494d0c377922ed32381680041ad

      SHA256

      44b6c4cfa1ec10865fb35253a1894547c3675ce1b91a7ef8a5fea38530c27027

      SHA512

      ba9f7b8d62cb3925b20324b9dc3a4411fa8a976cc4134d63d5767b0daa5b8b31ef6c7c5750b4d49a6b00c920b6b8a6b1b3617a7101542d573440fdc5930129e9

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
      Filesize

      1.9MB

      MD5

      152ec162f265ff8830fc1ff556517f48

      SHA1

      b75ee017a90a1e4401b1ddb441e76a3b2eb62e57

      SHA256

      90497e14d6311f0e1be53ec0b2df746fab04664d12b98c07b39664015a95db39

      SHA512

      9115f2447430adce2784fea4a3ae6d3d7a6d32412ce4014e90721d318315c9e0dbec067268be72862fc5d99c873c8b48c15cf837abffd080e9b6734f5bbfb8ac

      Download Submit

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      Filesize

      1.4MB

      MD5

      87d17650dde086803e964f409d7aeed5

      SHA1

      60093de15f7cb08bd5744746475b3c66d88af696

      SHA256

      cc88381bf121c965ad0255fecd2b5d1d46d2b5cf6206f3c9694afc1ea2a725c4

      SHA512

      d6ff93d487738f4fadacc7384998ff5bb812f809ab361c9fa26132e54bb61d1c101a13a8734928af4128583935f5cfb1961ac7dedc1f6683f54222aec397f432

      Download Submit

    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      Filesize

      64KB

      MD5

      5f8f110ac75bad28a7884af2ba010e07

      SHA1

      08030cd226c16e345ce5c5663cbc5bc3448c58b6

      SHA256

      e8c5476b50ec00cdc801cfe9357093af5a9198e7a3948b2ceadcabac5387ac39

      SHA512

      7cf57ebce3fb20a912aa0b9608653e43c54d2ca476e70c2957473a0b23131be5ee9a5ba632e11de70aa51b33e8c218db840fd64f7ffd0d46f13b2b9b4de40221

      Download Submit

    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      Filesize

      2.1MB

      MD5

      37e31420f5e9c36fe6200fb5c817b134

      SHA1

      52ae6bc09f91f11212de39c1fe0f1cf9a4d004ac

      SHA256

      d35e9eeab5b8ae5dd53b5c5afac57b3600aca733b798f284489f03897d53164b

      SHA512

      0c0857f754436c8c8c68bf372031abce1f20d07728d3fbc378efeb725b33c8935470feab56831f567b0262fdd9f0dfad8ba8a84268741d81a54a777bd1391036

      Download Submit

    • C:\Program Files\Windows Media Player\wmpnetwk.exe
      Filesize

      2.0MB

      MD5

      fadb93bdf75406013b9eccafe3a634ef

      SHA1

      31ee7eb629b78c020308c26ad9394acceba29448

      SHA256

      36bd465f850cbaa13f2ad79822e378ea4e53ea7f8f174a69e70fcb430a4ba494

      SHA512

      ee6b29d112e86a26ef892785d2229744714e3cc3de833f08b10bbe58e6bf3f2f3cd8b302b610a51f5e38fab9f1481c3f3fa45777072b0742a84375bd73538fa8

      Download Submit

    • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
      Filesize

      24B

      MD5

      b9bd716de6739e51c620f2086f9c31e4

      SHA1

      9733d94607a3cba277e567af584510edd9febf62

      SHA256

      7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

      SHA512

      cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

      Download Submit

    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
      Filesize

      1.3MB

      MD5

      05c9abb0940b5046976b4badfd196eb9

      SHA1

      1465794ac1efad103d9745064be6022dac0423aa

      SHA256

      445f4982a9f5bfe232372fb10c11f6dbc70b209f25642c971adf42009884928a

      SHA512

      61e9a331d7a3506d7016b3481993bdacada5210da0013db4f8d861b1e4e9f229225c1d76e08e301205567666a2faa7fd04a3fc63c2881be5fd8c86450d7345c1

      Download Submit

    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
      Filesize

      872KB

      MD5

      9ceb65236a036f610dc1bd46567a56cb

      SHA1

      3f830ed386d9369a8fcbae1382da3351879c9b66

      SHA256

      55652441bab21d6000ef3831f1a0c8b4330223566da36608eb2fa9d054282637

      SHA512

      01dddb0da06bbbab158e3e48f329254ea4fb6617e46ca03991df71707a175cb79520f1e4b22e747cec8236d6a32dee5c806fb22c5f60413850a3aad18cb17147

      Download Submit

    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      Filesize

      1.2MB

      MD5

      37cb476b24d22f51cc860771a1e4d78b

      SHA1

      2c529f566441226f3a15aec07f00e26ebdb84ac7

      SHA256

      494d63c0190ffae4d3afbbabe6bd0a217a15496817b03f340e700b7f866da641

      SHA512

      085c02a02d0e2734f8856350d4b967838d42cf0a8247fbfce7752ab1779be682ef91c1b7d0e91fae826db88c2feef7df002f088918abda64021e98505068da47

      Download Submit

    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      Filesize

      1.3MB

      MD5

      03a338514dcd7c82973206832244d9e3

      SHA1

      adab5c65c76c2d8cf9335c2d71325e8afc795f23

      SHA256

      f6ccc20d1044262384cd12b69e2857e878e7178b937e063943e7a3de9275d330

      SHA512

      83e7e46ba8df9efd5873e6d2f7f039771334bf7a2a9be5ee31a422092cbaef5a4b5b22194e11a912d82d6ce7893b03d602788d7ef54b60851cc704b83c96a527

      Download Submit

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
      Filesize

      1.2MB

      MD5

      1d06cd66bf86b6b4e6a059cd5c733cd9

      SHA1

      ed28143794f399a6fafdccc0112d448dab333b0b

      SHA256

      420b80082b8273841dfce79fa887032fdf5ea3cc873cb12d66d73070962829f4

      SHA512

      9a105ec83fbd8bfafa93ff2cebf6d2f318f11182960429f959506b7dd3263c653d6e7bdc4341dca4e19d56cda361b65328ff5a2b482afc5ccc4e0be42ec1ce3d

      Download Submit

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
      Filesize

      1003KB

      MD5

      49bd8a6e3efe49a43f9ad9ffb0aa00a6

      SHA1

      773e8786936cd1ec5fa09bcbe4e250f2af71458c

      SHA256

      4f6c22479cb9592d070f0d458b979edc6a446752a9a92df709bd5c3634b10992

      SHA512

      40aeec500e98f49f4eb6d1a5ec456eed09e896fcc17ab140cc8fa864c03c9ba96c993e70666460f5fed8253e6029b3045ba4d4be43af1f30c2a72d9aed9ac4d8

      Download Submit

    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      Filesize

      640KB

      MD5

      c347c71c3ae3d1e7d6ee6bc2eb7c5433

      SHA1

      ad2b7b073565f3375c3d6cb3117b8f5866df9242

      SHA256

      cf58af22cf89debcce68c7d348de294a6995484131b436fb1881eb915e1d0a43

      SHA512

      febebbc9a314142aed76f4d1a9ef32d55825a8d8e3c7b6771649585f60810fd3f2acec719b7c1726544e2356ff1ca9dd6173b104e484f6904a848d74fc8f697f

      Download Submit

    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      Filesize

      384KB

      MD5

      ea461c988140ed0b7d575028be778be5

      SHA1

      8aee44cdc4352cba5f25b24cbb812654778af012

      SHA256

      323188d143b65622bf3577e5fdb0c51f8a6639ffd9efdc175d8aa8a2e3c0c266

      SHA512

      11801db58e912765aa469a388e039c735ca018017fabb185a9610fa91cd881f5800061671842a69f226285626d4d9a625a5acddcc45880bf1fcc92cf915f64fc

      Download Submit

    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      Filesize

      1.3MB

      MD5

      ed2a2223b57f4d0e241936d991fc5342

      SHA1

      ccc575f4137496bbca505c255b486da911b9a7c7

      SHA256

      77f63c0bc1aabadc84ee410678baa8393894e4517a57821428838f5465075348

      SHA512

      ac64757753d81146153908d10f86a52047ab896d36e67b461940de89ba4309fae6d5e857d2495395c0c0b43d40bcb9b4c0a30b4676471d4d257dd75047efffd1

      Download Submit

    • C:\Windows\SysWOW64\perfhost.exe
      Filesize

      1.2MB

      MD5

      844e7120dd1958360df21a5e53f418c8

      SHA1

      c7b6a9abcc340e61a31fe317dc5586ecf386ab78

      SHA256

      bfe031b9b3e44b853fc4936cb16a8730ed2bc0f9ca2e16b7b9a1889f2317ca97

      SHA512

      d216971a3a1b801bfe61564f9ad2c1b903ca0170a013cdf3bde955b7f58fcca49784a6290243473b2945bf0337b06ddab0d91dbc81490ab020b75309b8c99585

      Download Submit

    • C:\Windows\System32\SearchIndexer.exe
      Filesize

      1.1MB

      MD5

      e855d2d8c2545a3aa2154b0d229925d2

      SHA1

      b03e20ad5a8dda88a871bae1b45c0a47b2c7cf28

      SHA256

      76aec3f9ea10b5dba7f1285fe9aa6cc3025fbd255688808204f5a1e7fc1387bb

      SHA512

      a7139e66f044ad20e51700940abb80275a7dd2f35be8ebfaed11a20cbbb767508bf8ab87df85e5cd95c571dd1e74c92b4764128a466bdc48acb2326b4e3ba1e5

      Download Submit

    • C:\Windows\System32\VSSVC.exe
      Filesize

      768KB

      MD5

      948e58c31220a178e2ab7da280f82eed

      SHA1

      901d137bc716604873198df061a282e4d001b864

      SHA256

      beb368a46629f945b7d49455875185d14b1f7b81e7cc570153654170faf8231c

      SHA512

      2d2d9220eade21b0c20f3f3bcdff5cb2bad61225eb4dc638fa6294ba6db7dd4b860be6deafea07030e449bc29eee64f696c7949f277c7a94ca214334bb0d2ed9

      Download Submit

    • C:\Windows\System32\alg.exe
      Filesize

      1.3MB

      MD5

      009aae0394923d58038ff2ffa4bf644d

      SHA1

      95e9bce21bf45d8d3169412917053c15f5f55098

      SHA256

      ae7f5d34bce22f87cf694ac6810714b64772184c30b6d38e87d56f1eb3e7aafb

      SHA512

      724c7be926d8e3831ddf9cd3abd849d2b5cfdbd69134ba5a5d465a7406cd49897386cf03ada439934ab66ab5dfb8a3c4db7772677215d7d4df9d0f7f8e597723

      Download Submit

    • C:\Windows\System32\dllhost.exe
      Filesize

      1.2MB

      MD5

      d051076ea41f46c49ad4883ba364498d

      SHA1

      3656cc3a47c29de8d6850816065723bfee9dca0a

      SHA256

      a6cfec427fcc284a2e51261f2892f8331cd3ecda00272e6f6446ae7fd5c0a56a

      SHA512

      1af6fff595e25c2d30e94f7df5c084e29b18a9f295bc3687ce496e30e338b05abc73d4d0730623ca0780946f7095e0f50af20f66d08d611f4de22d40ba4f6589

      Download Submit

    • C:\Windows\System32\ieetwcollector.exe
      Filesize

      1.3MB

      MD5

      6e2467c85ae9cb0f569ed218f26c9061

      SHA1

      40fa698164f925622e805927edb342504e42ae37

      SHA256

      ec66b0158eee21043dde19b0e4d28beb6c2bd6e03283a6b878c037e09556c421

      SHA512

      d65a8d5fe17c6120966b5be5d8d905e4d79383ac79044734d72ae9c9e634ee75de9519b75c1081b81a082a176f063dd9e403001e3fa0c9ddb8ae904ae4e2a534

      Download Submit

    • C:\Windows\System32\msdtc.exe
      Filesize

      384KB

      MD5

      48558b8da98548dc34683519610ea58b

      SHA1

      2ac010ebfc4e525f40867ed8c48d82e418082dd5

      SHA256

      47c40a4b807d0bd53393b14055388aa35bb10e387de41e73e55c6be509848422

      SHA512

      9705f754c4e39de70692843625f8c8dc3d9c225b6f1edf2e492771c8261ba003c753d1b69f37151ea1fb947fb835779428153303da2bb658cc911bd65fd0f8a8

      Download Submit

    • C:\Windows\System32\msiexec.exe
      Filesize

      384KB

      MD5

      66e824ca2ba09b1c2fe4d9223ca1b47e

      SHA1

      d132948d15229cb2120da2caf54a7f5326856178

      SHA256

      bae61e9129894c1ad5154edd3943ad6f857f33b0bc1643330d271d45fc9a13ac

      SHA512

      c4855e29240e54c81659da1af51a5d9c63f8dbd7d526b474f55f50c63c2a61d36220fb1e1f4b5345d713376bdff47f019142bb4c05b7f945c097785e8da67173

      Download Submit

    • C:\Windows\System32\snmptrap.exe
      Filesize

      1.2MB

      MD5

      e06f27f36fe2393a1ea449d4f3148c25

      SHA1

      cd707a8e1630dd39820130e1477dda7d1213a5e8

      SHA256

      4c54ff027de52c0f1cd08c0a1b228ed3da3fea64a842df57c4788c90db88a2ab

      SHA512

      0be5922000257fa6a8f778e64fb0c44ecfe305414837b445d65253bf475845f94f632ae8e25c41aa6648da3705586d042028c9b4122909b086ff5c9675949232

      Download Submit

    • C:\Windows\System32\vds.exe
      Filesize

      1.7MB

      MD5

      306e0a3ff06fb62108b0ee7c6a874911

      SHA1

      dbd56bc60154ce715c31b0e61b09eb9307053981

      SHA256

      92eca376604f52a8ddf4f41b008256ac8e8a623df6ce55f760101950f6707bd0

      SHA512

      0039817fa94f0ad19220f8115f57afb035a75767b89bc39544db6e25d027b12700f58e4e12456478472c26527617b27893b4f77d40928a85256816abde226e68

      Download Submit

    • C:\Windows\System32\wbem\WmiApSrv.exe
      Filesize

      1.4MB

      MD5

      15bb5baeb81a89cad7b8ed33f01c07ea

      SHA1

      052d9431cd8db609e7271ee14e78d2a99a37d5e1

      SHA256

      5e23dc6421c0a7d453afb38939925cf1b664861daf7a92fb3225a89850749ae7

      SHA512

      972e3ec6a8c30509ce70f6224e71b1a4cae9c2ccede86438379a0735f219266bf0ba4477d3fb73c267a89c12c3c340ff6c5098df36e201fa9e1328c4be7d0506

      Download Submit

    • C:\Windows\ehome\ehRecvr.exe
      Filesize

      1.2MB

      MD5

      8381c2bc5e4213e9ee9379cfc346ebe1

      SHA1

      16f9af0043e1f90979c244012b9d1e016460deca

      SHA256

      7cb2ab7b6fa6d4b567c9bc640349b58681df97d63b2cfb27298ae546c1276ce1

      SHA512

      745a27055a9987e1e4ab644963d9ae7d7d7c5bdc209d3eccdb427bb9616e66de51b47fcc9471aca72cf9b1cb3422be841665312cadd5a9039952742d78fb4665

      Download Submit

    • C:\Windows\ehome\ehsched.exe
      Filesize

      320KB

      MD5

      cdeda19b5b23b8536aa60500067a953f

      SHA1

      277b65a07ae7d2cb6b73eaf7a628aa78f92f1005

      SHA256

      2502ecadc42ce24d253eb179e48c9fd2d46bf5872d900913fcbba35492f88cf3

      SHA512

      67dcf42b3d3d8211059b4368368796bbea97079b150ea2d282a275e4c4b2834e82af6332eb2d05c65a11b3d9d16f5587e55ddb5b1a35b762b222ddbe20c1a515

      Download Submit

    • C:\Windows\ehome\ehsched.exe
      Filesize

      1.2MB

      MD5

      e34324d72b708a13576bfec498ee693d

      SHA1

      969cdbe23bdf54626f8fe5fbf999ef701e7a2684

      SHA256

      d174f67eafdbe8fc767d26ced567ae722913e8f4c28ae77c2845170ccffe7dc0

      SHA512

      d91fc80da250c4cb010cce3daf6eb7828a1ed627db4c594e5bc581161f920d3e22f6a581d29bdc7a51fb69d4b4a689e3462507bd886592d890b44df2dd5883db

      Download Submit

    • C:\Windows\system32\fxssvc.exe
      Filesize

      1.1MB

      MD5

      ec31cb2a6bd43698fb021d5ced1b167c

      SHA1

      9a2cd82e31d1e9fb4d19065ed9d68806800b3010

      SHA256

      19847b45f98fc9200dc44495dcdf8a8d143171d892809d67d21d3571e61dff02

      SHA512

      d5ff17ba23a61accaeaaf3e75bb15311a99ccf89082d4e4d9a310ebada2a0855be93c6caaaeb28ab1763896e40984bd525c45b3f795a5f50b3761f8194569f68

      Download Submit

    • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      Filesize

      896KB

      MD5

      7aad30ed354858849d50cf83956d3c6f

      SHA1

      1aa7d7561ef6b6add7d95320ccc85d366073f501

      SHA256

      f851f73afa40100f80dfe546bc5c34b1c5373e1f688bed373a192ca96a6f16f0

      SHA512

      09853eb0885f3d303143d90cab1e544e469028752da20eb0951c9eac8c9ee763db4ae5c431d8275b0bded188ea453fe3fdb31469d5982ee7dde4ccfa798b734a

      Download Submit

    • \Windows\System32\Locator.exe
      Filesize

      1.2MB

      MD5

      942be66cea7113e3063a707e16bb1c9b

      SHA1

      81702f41b2298f635fc2f1e26ce220064365d218

      SHA256

      a6cf8bbd61d1d0d05b113e092db68cd6514859324448ae1b80af890fc477d21d

      SHA512

      43c699d5f9cf992c0ba0a771546885034e7c3a710951eb084751baf9f7e99797b6ab17b444327bb29b0e56ca109b00329e729c25e0d469dd9b4ac1ee3e8fdd32

      Download Submit

    • \Windows\System32\msdtc.exe
      Filesize

      448KB

      MD5

      81bb9280f21402ccc5ac872948c07e17

      SHA1

      ca5bcad9351fa9c873bd07e3fa529273eb138126

      SHA256

      df85c33551b83579c9d784e5f66766950238c1adee801e9a43f10438461cdec7

      SHA512

      668596792ad976b5800a528e8c5a1d6012c356270b94b61cebd31149e11e94fee78b7179a17d3144ebf7acedc9aff998220d520f93eb9bde4a10805a466d7ee0

      Download Submit

    • \Windows\System32\msiexec.exe
      Filesize

      512KB

      MD5

      eccbbfc64a61ccced376098e0026cb42

      SHA1

      36155cd5cbcbc94f3aefc70a3d0683788ee46943

      SHA256

      6b2734a5363bc45b0db36c71ece79283f0d2bac47531807bb8d84eac972d2ae6

      SHA512

      8412031de6835a05826a79d25c36a9d6170541d02a2cc03c7050d35ccfd8478a7fde814356a374895009cb6cb0e4f71246e0891228c06baf1750e43ad0116c6b

      Download Submit

    • \Windows\System32\msiexec.exe
      Filesize

      320KB

      MD5

      a425c3906f17fc1e6af81c6c98b5ee37

      SHA1

      738cd19646e1cc3950915ab0888805917cc0ef94

      SHA256

      3b9c96f196f9bd95f93466bb763ec54ae2a871c4db5d68a73fd0b4d4dfedbd5c

      SHA512

      eeb20136d054c23a610bdb5d5d1f963ff747b6014fd4aa6e8399a766056629232eb130de58e5582c9ea49b650dcf356436e20997942b52911bfb98a6c1310924

      Download Submit

    • \Windows\System32\snmptrap.exe
      Filesize

      832KB

      MD5

      06b4bedf84e495ff536580619a953070

      SHA1

      faf1e0c997b9c601bc920985985d610626be642e

      SHA256

      f18c68adaac1896b3e6eeee76b5d8dae5f1d425ce691c844ddb8644dd2c8e75f

      SHA512

      b97e17d96b9947f295727844320aff3abd9d728021527620bef25b850f5c6c722c50bc64cae736b600a68fca0e35dd878b598835d42b03a370d86e7de227732f

      Download Submit

    • \Windows\System32\wbem\WmiApSrv.exe
      Filesize

      1.3MB

      MD5

      bac799a357b60c91c694e20b0da64822

      SHA1

      5fc1a8a068462c8f4d6f93c1e02ae03f4f1fcc0d

      SHA256

      b8497dc817748e3fc2b0dacab048319e81ca1e13645568fe14d683783d290c7f

      SHA512

      fcd8e4fdb0cd1ab37e601cdb4717d78c852537b4eb8a9511d95b1df42a83d686a8ba2a96bf7ebb75496835fa946e38f6c1fcf4f8547c9cadc9f662433deba2ae

      Download Submit

    • \Windows\System32\wbengine.exe
      Filesize

      2.0MB

      MD5

      8209cfabaa7cd7425bba165114a3718a

      SHA1

      11a285926b0888984b4c6a05856a7dc2895bc84f

      SHA256

      c362b50eee2a5241065880f8ca3e33c175cd18bbd24e8fdd8fb884afbe991873

      SHA512

      dd830401efa9f829e112d4349387502ae336dcd7125b9150dac69b2ea1830a9a2bfc5a6b1ac079008e8431290c5fe88aacab05bc5b5636030210c62e7fd779c8

      Download Submit

    • \Windows\ehome\ehrecvr.exe
      Filesize

      1.2MB

      MD5

      e93481f8dbf3dbbb4328cefabe8bd466

      SHA1

      f14c710862b4b590329cd1ce775e00beff28a751

      SHA256

      15fbc29a87c5ed3e4e3ad7b8ffe3e610f5349a05bc37e3abeb9597befa778103

      SHA512

      258c7765feb98eadd642ef5e015a86611df1d37b76abdec4caff90c597a0135e059a706647a2e3d05d15d85d5a95c8374c109e89ed1d5533c34e2040b6ab5bbb

      Download Submit

    • \Windows\ehome\ehsched.exe
      Filesize

      384KB

      MD5

      e80e7ac8136359138ccf6d2aed9ad867

      SHA1

      04d107ecce28843f27c153532b01e8a86a9a1d02

      SHA256

      0e45b5a73f2b4cc8f14a70a03fc8e4e877559e166802ed2d8715703e49c89122

      SHA512

      526f5d0bdbd3a9bf339008a4846dbc863f32cdb2eb50c40784c7e3de752470bc5d04cb0a85018176a17b5da2d74e8bcf48d0584e30b1a420aefb432a419e535e

      Download Submit

    • memory/444-111-0x0000000000850000-0x00000000008B0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/444-249-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/444-105-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/444-125-0x0000000001380000-0x0000000001390000-memory.dmp

      Filesize

      64KB

      Download

    • memory/444-133-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

      Download

    • memory/444-104-0x0000000000850000-0x00000000008B0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1068-199-0x000000002E000000-0x000000002FE1E000-memory.dmp

      Filesize

      30.1MB

      Download

    • memory/1068-232-0x0000000000450000-0x00000000004B7000-memory.dmp

      Filesize

      412KB

      Download

    • memory/1108-259-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1108-284-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1108-237-0x0000000000420000-0x0000000000480000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1108-235-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1208-257-0x0000000140000000-0x00000001401F1000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1208-124-0x0000000000870000-0x00000000008D0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1208-116-0x0000000000870000-0x00000000008D0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1208-118-0x0000000140000000-0x00000001401F1000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1208-123-0x0000000000870000-0x00000000008D0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1440-240-0x0000000000160000-0x00000000001C0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1440-239-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1576-19-0x0000000000430000-0x0000000000490000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1576-90-0x0000000100000000-0x00000001001E3000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1576-12-0x0000000000430000-0x0000000000490000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1576-20-0x0000000000430000-0x0000000000490000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1576-14-0x0000000100000000-0x00000001001E3000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/1596-247-0x0000000000270000-0x00000000002D0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1596-246-0x0000000140000000-0x00000001401F5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1632-188-0x000007FEF40B0000-0x000007FEF4A4D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1632-279-0x0000000000B30000-0x0000000000BB0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1632-275-0x000007FEF40B0000-0x000007FEF4A4D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1632-262-0x0000000000B30000-0x0000000000BB0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1632-281-0x000007FEF40B0000-0x000007FEF4A4D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1632-185-0x000007FEF40B0000-0x000007FEF4A4D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1632-187-0x0000000000B30000-0x0000000000BB0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1960-290-0x0000000001000000-0x00000000011D5000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/2012-1-0x0000000000240000-0x00000000002A7000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2012-72-0x0000000000400000-0x00000000005F4000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2012-0-0x0000000000400000-0x00000000005F4000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2012-7-0x0000000000240000-0x00000000002A7000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2012-6-0x0000000000240000-0x00000000002A7000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2096-103-0x0000000140000000-0x00000001401DC000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2096-26-0x0000000140000000-0x00000001401DC000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2164-256-0x00000000006F0000-0x0000000000750000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2164-274-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2164-276-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2164-231-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2164-193-0x00000000006F0000-0x0000000000750000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2164-190-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2200-273-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/2200-138-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/2200-144-0x00000000008B0000-0x0000000000910000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2336-127-0x0000000000400000-0x00000000005E7000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2336-58-0x0000000000230000-0x0000000000297000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2336-53-0x0000000000400000-0x00000000005E7000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2336-52-0x0000000000230000-0x0000000000297000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2436-265-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

      Download

    • memory/2436-270-0x0000000000850000-0x00000000008B0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2436-272-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

      Download

    • memory/2460-219-0x0000000140000000-0x0000000140209000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2460-228-0x0000000000FC0000-0x0000000001020000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2540-45-0x0000000010000000-0x00000000101E6000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2540-81-0x0000000010000000-0x00000000101E6000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2580-233-0x0000000100000000-0x00000001001F1000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2580-238-0x00000000002B0000-0x0000000000310000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2580-287-0x0000000000550000-0x0000000000741000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2580-282-0x0000000100000000-0x00000001001F1000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2580-236-0x0000000000550000-0x0000000000741000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2732-30-0x0000000010000000-0x00000000101DE000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2732-29-0x0000000000320000-0x0000000000387000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2732-66-0x0000000010000000-0x00000000101DE000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2732-35-0x0000000000320000-0x0000000000387000-memory.dmp

      Filesize

      412KB

      Download

    • memory/2824-89-0x00000000003D0000-0x0000000000430000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2824-93-0x0000000100000000-0x00000001001D4000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/2824-97-0x00000000003D0000-0x0000000000430000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2824-150-0x0000000100000000-0x00000001001D4000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/2988-79-0x00000000002F0000-0x0000000000350000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2988-71-0x00000000002F0000-0x0000000000350000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2988-74-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2988-136-0x0000000140000000-0x00000001401ED000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/3012-293-0x000000002E000000-0x000000002E1F4000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3012-253-0x00000000003E0000-0x0000000000447000-memory.dmp

      Filesize

      412KB

      Download

    • memory/3012-251-0x000000002E000000-0x000000002E1F4000-memory.dmp

      Filesize

      2.0MB

      Download