Analysis

  • max time kernel
    45s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06-03-2024 05:35

General

  • Target

    3816-142-0x0000000000400000-0x0000000000654000-memory.exe

  • Size

    2.3MB

  • MD5

    28af75842a4a507ed1bc04782133c1cd

  • SHA1

    c0198e76b972772adf04b9a37b575db0e2a1a65e

  • SHA256

    5ab9feae38e3b0f409af2261cdddc44676b301ed4df03adec3bcae88d1fe58da

  • SHA512

    15739906e7041e4fd7e65c90eb65513113bc7356863285a881a932c35223a56e269355a1e00e504f88d2c0dda1817e0850fb0340c855a9efd1b82e0384257590

  • SSDEEP

    24576:wxgsRftD0C2nKGH0Djsf9nz4mloFQnpXUMPQDR6q79dA:waSftDnGUDYf5zaCpXxPuR6E9dA

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 10 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Drops file in System32 directory 17 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3816-142-0x0000000000400000-0x0000000000654000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\3816-142-0x0000000000400000-0x0000000000654000-memory.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:2464
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2560
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2556
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2568
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2588
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1f4 -NGENProcess 1e4 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3020
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1e4 -NGENProcess 244 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1356
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 260 -NGENProcess 258 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 260 -NGENProcess 1e4 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 26c -NGENProcess 258 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
        PID:1652
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1b4 -NGENProcess 188 -Pipe 244 -Comment "NGen Worker Process"
        2⤵
          PID:1832
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 27c -Pipe 274 -Comment "NGen Worker Process"
          2⤵
            PID:1452
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 280 -NGENProcess 188 -Pipe 250 -Comment "NGen Worker Process"
            2⤵
              PID:2132
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 288 -NGENProcess 268 -Pipe 284 -Comment "NGen Worker Process"
              2⤵
                PID:2628
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 28c -NGENProcess 258 -Pipe 280 -Comment "NGen Worker Process"
                2⤵
                  PID:1652
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                1⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2976
              • C:\Windows\ehome\ehRecvr.exe
                C:\Windows\ehome\ehRecvr.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                PID:2704
              • C:\Windows\ehome\ehsched.exe
                C:\Windows\ehome\ehsched.exe
                1⤵
                • Executes dropped EXE
                PID:2768
              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                1⤵
                • Executes dropped EXE
                PID:2720
              • C:\Windows\system32\IEEtwCollector.exe
                C:\Windows\system32\IEEtwCollector.exe /V
                1⤵
                • Executes dropped EXE
                PID:2480
              • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:2856
              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:2996
              • C:\Windows\System32\msdtc.exe
                C:\Windows\System32\msdtc.exe
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                PID:1780
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:1824
              • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                1⤵
                • Executes dropped EXE
                PID:820
              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                1⤵
                • Executes dropped EXE
                PID:484
              • C:\Windows\SysWow64\perfhost.exe
                C:\Windows\SysWow64\perfhost.exe
                1⤵
                • Executes dropped EXE
                PID:800
              • C:\Windows\system32\locator.exe
                C:\Windows\system32\locator.exe
                1⤵
                • Executes dropped EXE
                PID:748
              • C:\Windows\System32\snmptrap.exe
                C:\Windows\System32\snmptrap.exe
                1⤵
                • Executes dropped EXE
                PID:1812
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                • Executes dropped EXE
                PID:2928
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Executes dropped EXE
                PID:1956
              • C:\Windows\system32\wbengine.exe
                "C:\Windows\system32\wbengine.exe"
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2756
              • C:\Program Files\Windows Media Player\wmpnetwk.exe
                "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                1⤵
                • Modifies data under HKEY_USERS
                PID:2948
              • C:\Windows\system32\SearchIndexer.exe
                C:\Windows\system32\SearchIndexer.exe /Embedding
                1⤵
                • Executes dropped EXE
                PID:2848
                • C:\Windows\system32\SearchProtocolHost.exe
                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                  2⤵
                    PID:1540
                  • C:\Windows\system32\SearchFilterHost.exe
                    "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
                    2⤵
                      PID:2988

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                    Filesize

                    1.4MB

                    MD5

                    8d14130228b20951c43cde1439d3f848

                    SHA1

                    f052c1ff08ff1fd397ac5268e0937f257d3bcf44

                    SHA256

                    c465604917cc97730dc17f520de90f9de779a873a38af75c40a0ca5e175b5d67

                    SHA512

                    62602241b37cb2d954a6f94d92c1feaead656c05ba29c3cb87397bfa0579860a89ce165e4011841f59ff13ced23174e1b6c6de1581230a5b506552bed3c2ef79

                  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                    Filesize

                    7.3MB

                    MD5

                    b7da20c653cb278d228bf7864b759cf2

                    SHA1

                    4684fd56d279e2cd363cc504ddefacb7d1003bb0

                    SHA256

                    9b85aedf9df0b2a3e5dbc2da68bf3803228788d86288143f9ad7443c8a226443

                    SHA512

                    7a853d16510145e975632e96d9443424766561927f19e1a2268ed8900069452be1d84eef0be22fae0fc562500ea60216b9d3a657bef4a0bcb462ef63926b81aa

                  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                    Filesize

                    1.4MB

                    MD5

                    c717610abc0497f7c41ef142052b4503

                    SHA1

                    ecd564f24b4ca4d6e32d628481764510efdb801a

                    SHA256

                    f92b40e0a3ca976af5480bcc87e115850fa61bd897357f7785e943a92b9f7b20

                    SHA512

                    ac3902e37149787f625e6a07d5b78f38d5349c03ab0127d1aef819c92b425f1eb17ea5a641fef801505d6e841141bfce022a2e3a6265bec219f5e5bc49c7958f

                  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                    Filesize

                    320KB

                    MD5

                    63692632c8e5c9901f81a727762ced34

                    SHA1

                    0904b475cff63e325d1c107e23ef8ccc13e99818

                    SHA256

                    a92a6df4f5bf87126d7a864b91274bed7860be99e7866497bd0254ef08892d36

                    SHA512

                    dfb67aa50b36774fb332e15df0812fcd911598065c9202600d670fc1c044e09838eae054caf5ee962e1212222b95b4201823ac21a901464754d57aa13977d60a

                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                    Filesize

                    2.1MB

                    MD5

                    9efa919ade29fb8151d53424bfbd7c57

                    SHA1

                    6c425e006b79555e15c3f552c514f103e8d25d00

                    SHA256

                    25afb2c35e525271f3e58b9ffa2019d5dc88e191c5f0842283755a3eff3de53a

                    SHA512

                    0283ac9aeb66ad4d6f10e4d49ffd39790ab7745c6d5c6bf66d9d29df523f590281d390c6dfcf52f66c4644369cd1a22296afbe22ada0077cab779d1623d45057

                  • C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe

                    Filesize

                    1.4MB

                    MD5

                    40d75281567f4b6830d639edac856120

                    SHA1

                    8f37073aae6d7dd4433fd2e9006fb3292035e42f

                    SHA256

                    4c32713b7b5184d2e12601f9b9c5ac32086793e1201f456fe81cbadf6a0e3ba6

                    SHA512

                    52b40d55da6bda51321401a1eaf3d6617138392276ebc74c6f768effcb00a69a917c8a3273fec84ccac185362c4ed4a7455bae26f454e7e80f00ed8d8e797b92

                  • C:\Program Files\Java\jre7\bin\java-rmi.exe

                    Filesize

                    1.2MB

                    MD5

                    71898394a76544b3289359695554836a

                    SHA1

                    e99ea229322289b407ec5398a02d15d567b9f3ed

                    SHA256

                    d1851fa6cb35561ab34d4190571641731aae5995dfa2ba230d7a660b014563f4

                    SHA512

                    1f4539c1622c4aba30f292e6acdcbace1aaf5b76b58a6bfd0964538cd678530f4bb36b532193cd97b213025ea5bf90bf0175a55ffd690808ab1bccf003a6aa42

                  • C:\Program Files\Java\jre7\bin\javacpl.exe

                    Filesize

                    1.3MB

                    MD5

                    ada24caf8fd896222e3db598df082ad7

                    SHA1

                    4cf9a67d20bec1dc1ca30ac1bc946be537e684cd

                    SHA256

                    56416dae77f978daa5686b4c22ab993f27070530984abe44bbb845c13adf73c4

                    SHA512

                    58404f12f324a4d11d7a9f9cc3fe491a8c2868cd8ebb063b5e95e434dd14bd141c45f0efb26536b5d4f49cf58f7ec9c0702d479d630d065db2ad1f938b9bc966

                  • C:\Program Files\Java\jre7\bin\javaws.exe

                    Filesize

                    1.5MB

                    MD5

                    668c167d505364c44edb94460d0128b8

                    SHA1

                    99b2e0c800e93c150d64927d7f05695187a870d0

                    SHA256

                    1dd9f9c05e3d0fa807d601c1a69323e7b92fe910afa17d559d33196cc133d75d

                    SHA512

                    71639b35afa6859ec7b98efda31f844f20c697b5fc7a74da052fb9e745cd3f86b724accc5ca6936a82d38ddd6d8766b5378366e6d7c0b8c9787aaadb9328007d

                  • C:\Program Files\Java\jre7\bin\keytool.exe

                    Filesize

                    1.2MB

                    MD5

                    cd36f322fada87c73d9cd805de466787

                    SHA1

                    b4ba224aa1ab41eeb4f29296ccc1e2fac88ea533

                    SHA256

                    e0c435952b32e173fe23b4d1c5f1c8a490b08757ee11009c369bbb1ed7220079

                    SHA512

                    7a09f42de2119d094675eb6f30b10d85172234b2efc618ed8afbd976d3d66fa6aeae5b91d052c7b83d81b23165134cf0286174c1f54136f75faf011fffc2cd6a

                  • C:\Program Files\Java\jre7\bin\kinit.exe

                    Filesize

                    1.2MB

                    MD5

                    e01697eb267b0ee5689d1d9eff1d2fa4

                    SHA1

                    d3f1999be4401ef52dc3505b5bffd591bbf640ca

                    SHA256

                    73c4d7fc4fa3e6e5dcf8444337a250ca5b77d83d179c58b7aac9b8afafd904c3

                    SHA512

                    9c164163162af316501acff3f643f64248d52bffbf136cc7debc0db15bbec1837e725c47b0add7e17f6d503f3808acd6d0aea40b91811f704786e78456ff617b

                  • C:\Program Files\Java\jre7\bin\klist.exe

                    Filesize

                    1.2MB

                    MD5

                    c035d4d04e1f3e8fd6e46de2813a84d2

                    SHA1

                    667b26a71bbea6d98b5037d58d40a5a6dce98b55

                    SHA256

                    e945262c2c31f296023f0c6fd5c6de85734ccc8bbde23ed8e788cc3c6d68ac52

                    SHA512

                    98ce69149ff77a86939e06196b5220097998ea05d18b00e57d72c0db42a3a13c9ff89248c37070fc640a56a5c69bbc17cb074fda70db6686c0d4d0361c1a741e

                  • C:\Program Files\Java\jre7\bin\ktab.exe

                    Filesize

                    1.2MB

                    MD5

                    c75e984cb0906bcf4927339765200399

                    SHA1

                    6ba0a9906a0ac2ac3f0d6c6152458d196d94835e

                    SHA256

                    99b75f8f458715d9cb0d039e652278aa2e553f143647b1a1d271df4788ef3b84

                    SHA512

                    5b6c0c63b72366bd48bca71a727500eafba045f1ad851c7bca4b7508ec9d89e1fa5f1e756796d08a76326048254d98c3afe15c5ef44ca484f4037e4a8a3ad9e2

                  • C:\Program Files\Java\jre7\bin\orbd.exe

                    Filesize

                    1.2MB

                    MD5

                    af68241e707edbc98d3dd92c3db88efc

                    SHA1

                    cfe4701a2908459d86e6d91ae95e46078d13d74a

                    SHA256

                    63c660292c561e48668bf9e6fd2f74271fdebf0371aeec11de8656dff283379d

                    SHA512

                    e8df12e3a5cd86bf50d994b900405280f312c245ef4fad008040025f45b0105ec72c0a10b24e9948669b18ab64388e800536366714726a7dec14794f37b1aa44

                  • C:\Program Files\Java\jre7\bin\pack200.exe

                    Filesize

                    1.2MB

                    MD5

                    21a456dca5fa361ffd0ede64af090ea0

                    SHA1

                    b8dc652486f22dabb56b5e4d9e10674d84b726b0

                    SHA256

                    654a0ddf61ca499c87d838cc948938950ee98abc5aa0b489a22359038ba8a3e8

                    SHA512

                    5625cb8126d7f2623173aa1d7b82cf935902053cab78187d3cf48e1e31d716c349bb4a0dd85879ba78a29b48cc9cb768087dfb0ff81e2b697ae5cae7c04c383e

                  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                    Filesize

                    1024KB

                    MD5

                    86f9ea1f543ed9ad5c957988a75bfca9

                    SHA1

                    cf70699e5d2d14385b9e194ed8e4d97ae9fae718

                    SHA256

                    fc48be2f19f2a58f4628ceed62e509aa14a84cfef15a9f3170e85202c9f96001

                    SHA512

                    24066285e1fa84bf59b0a4a6757660c102451a525edf057c28415f43f7abec2fde2b30346a661e19fdc4f83468c85ee43db80a196b2ed452b58e259f53984b94

                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                    Filesize

                    872KB

                    MD5

                    431d6ad7844cc6fdb577a95e47539d61

                    SHA1

                    faf8c85668f093125325e8a63c169f3d7013b57a

                    SHA256

                    95af5953af9aa931eb0a0fcbc5eb6900c7d35e12cb8009ac5ee8585dc268a830

                    SHA512

                    115e9f0d6d4b8951760fc105268ac6270bc3a0cf116f1d0530b6b5879cdb315c1b94cec12aa1f8d36928515544d91d1ed98e673f17906083707f5f4d3809265a

                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                    Filesize

                    1.3MB

                    MD5

                    801723a8b2bdaa65907a1148743b0051

                    SHA1

                    b3df290a5e9cc26fd406314b7995f07a3a4cfd0a

                    SHA256

                    90015d6ba12828e3a00f7d3ceaf0c3fe9ca0f4de3ea8d9fb709b65e66cb375d8

                    SHA512

                    601278e133e2e83aef1d19b35990372eddad9782f569f3f93ab72d3559572fa0bff4b6034fd3d546fe83bf4858269bab8c801fad82f84755279953c5be9b9532

                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                    Filesize

                    1.3MB

                    MD5

                    6935199a2fe6a4cbab66af5aa04ca1c9

                    SHA1

                    c1d1b490beb3659bf70cf179dea5ded7d5bd1ee5

                    SHA256

                    61b4b8a5af67993581d5477c0b1772abb6cc6bdba32577d7c376331010627ebb

                    SHA512

                    bfe368ffe5889d3c95e3d5e680eefcbeaf21b2ed16ff87784fc90dcb15c7a144ee90702cffb88cef302373e82a0990b9f21491a75d7118ee0bfb6e3c64587667

                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                    Filesize

                    1003KB

                    MD5

                    13079e83f468757f4de8005117fce3a4

                    SHA1

                    a61b83b764b530518197ef71c22dd0aed3496ea0

                    SHA256

                    90a77ee105cd17e448e8e5abae8711ea10c5eba519a18fde9c53dd439d93e50c

                    SHA512

                    05971de3af516ed916fe0d7ec877337b68315f48992c746ff5b71c13915e8f7ad69f0d5e6d436a9cd179fea87c5efe9bd26a6ab1b63fd2df5eab5c65a420a1e9

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                    Filesize

                    1.1MB

                    MD5

                    4db88ea457489682905bc7f9a92bf0d9

                    SHA1

                    b99028a0b5ff74360b3f312acecbb83233a757f2

                    SHA256

                    22de55fcb4215cbe46d1dd3f4517bed794fdbb121e69674cb0e7524e3224251f

                    SHA512

                    cd8f13abb63b6fb281468036198b7d34857e5283fc2cdf795079c3380280bbf13dbad8ddcd1a36a27719192e362581e3d8946aa36c737d027935fd3867cfb0e7

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                    Filesize

                    960KB

                    MD5

                    19743abbbf09a233140105ef87c5a925

                    SHA1

                    53fc300d8ab7d439ef6f9d53013e94ae2c8a1a81

                    SHA256

                    70771128dfbd28342b84d1bcbf7da6927d357f16bc5ffc43459268625177e5ea

                    SHA512

                    216b1d055d8721d7cd49cc0c516b3c2bf9dec48fdeeaa55519330a0d305836b38c42e4fa78b1f48e2e9a8075f418f7a40d3dcbf507c585596bfc0c3e9a478bf8

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                    Filesize

                    192KB

                    MD5

                    2f17cb12b7b616aae4cd03e90e62cf9f

                    SHA1

                    4b8b305fbdbaa834d56be61884ee76dec098df5e

                    SHA256

                    34cf2a9e246bcb5a4db5ed2d65124868879c8b1efe609115bebb3088711c76b2

                    SHA512

                    a0e777c8b43ab388f5f0b8f86280a5654d9be694ce4438bce6224f3185e12be84034c0a683faeb0c7c6bcfdee9d7b5d9674ceca80b5eee184c6aee625eab6981

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                    Filesize

                    1.3MB

                    MD5

                    3a739d2ee7521d18bcfcaa15bb3f085e

                    SHA1

                    a6f08032a56b4676029210be527a5754e949102c

                    SHA256

                    9da956bc90a5166dfa18951087f10fb692b73aa107666255f16b892fb150ddf3

                    SHA512

                    57693a615ac8d6aa8f4f7294d50feab38b564c6faed744b055ffe7a527e7716e2466d451525cacff5c44309b15864efdb6a06390e406b5b991e245ff2f2f9920

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                    Filesize

                    128KB

                    MD5

                    16dd15abffb2359e5eb24b02c084d6f1

                    SHA1

                    0e07d66eeed02cfc2056be3f2760ce6b56d50f18

                    SHA256

                    4495fe8ba71dd367bcdc52e7d723ddeb102213786244b5da88847cedc19777c6

                    SHA512

                    62e1194da82cf11ce64a1fc86f34ccf566f1b35b08042ff04ea69d283af0ed8f1131386ae6bddb384ee1e47996be003037de599bd0d2c4b1dbc665c77ce5c7a6

                  • C:\Windows\SysWOW64\perfhost.exe

                    Filesize

                    1.2MB

                    MD5

                    b9a5af5a5e65d03272b0c4d199081884

                    SHA1

                    ab27781f108e82fc175f5ec2701d40cc812f5bbb

                    SHA256

                    3681a82415976549a515c8d9c3ef2e6ee54b9adc9f43dd7efd8c42c34b2f226f

                    SHA512

                    7b5639d88f9cd6481ba7588d91ac48e9ae90c7b62272e4da73724ee3bfa355a6140a3ee7b2dc0a2a4f81dd7c679790c94a24be29bc166efde0a9f43c5e1ce92c

                  • C:\Windows\System32\SearchIndexer.exe

                    Filesize

                    768KB

                    MD5

                    b5b48e08039cdfefe18d3e208ffa3f53

                    SHA1

                    417067ca06cd37451f688bbed1766e7710bff25c

                    SHA256

                    c9dc88fb28a672091804d271f96d958e87f737b5743ad036458e5d1abbc2f185

                    SHA512

                    6e176c6de9f8764f1a2c260f7ddc69abf27815ef81a03726fae47f1d5249c67300d1d9e3e6c65b442e72722379081f720322bcf0b7d0a49871a59065edaae370

                  • C:\Windows\System32\VSSVC.exe

                    Filesize

                    2.1MB

                    MD5

                    66ccfb8339f06a03e4f3f9e2c087ba3d

                    SHA1

                    6666f5521431f623e4334be1f8e7af7973eee464

                    SHA256

                    806c2b7ce733776e732004b1c5cfbc68dd20920acebfa259fae41b92e55c3824

                    SHA512

                    15c2a5fb8628208fcf0403386a014b9f8f3161e193bf1cfce7c6b7329c4841867a81dbb3e380e698a52afc979d569ef5e5950d89bd2a01dcbbf547a2a4a3f1aa

                  • C:\Windows\System32\ieetwcollector.exe

                    Filesize

                    1.1MB

                    MD5

                    4250b6aeef438ed837f2c905a518e4c9

                    SHA1

                    a9ca19120db39cbf972048d7e8ad7769d57613e8

                    SHA256

                    4e570f058fd4837012fd4ff8ca3d4a13e7f23119b67dcb4d8de4fd81a2744244

                    SHA512

                    9600dec01e0f1c664d5dffd550e641a68af979a1a33c9cb441b7af9ae2978e566dbee00b58431cf22dbcb1105a5b727a8f3625719637b30746550593605ad15a

                  • C:\Windows\System32\vds.exe

                    Filesize

                    1.2MB

                    MD5

                    9d1d6b56d804859178a5c8a72af00b5f

                    SHA1

                    ef7e9d1dfae8e256b856aa64a467617192a1b93a

                    SHA256

                    a7e0cfcf8dfc8b0ef14047e5e041af41122c3d1efc46b34849229713049933db

                    SHA512

                    d785f8839b30ce6bccb019e6e7854857e053c56f5396e3a207e7445437d26310da4443d289c14a162d648801976d9c971339f1853cfea9251f5bc86c55706f2b

                  • C:\Windows\ehome\ehrecvr.exe

                    Filesize

                    1.2MB

                    MD5

                    4aca9e5a4c7b5464e7e8a95e44a2917a

                    SHA1

                    b23375726060be4ccfe3bd4b38d3bc5e869eba52

                    SHA256

                    6028181ee777a1b2b2772395d071cdbb9b6a41be48355d16854219af05faf00e

                    SHA512

                    7a1d1d529c03586fd3caaea32d90d591f07ab03289aed39edd38ecdae713da9f638ebf6eb96853c61a8217b115ef21c6a0bc39d77db38d7906d8b5dd0fa59413

                  • C:\Windows\system32\IEEtwCollector.exe

                    Filesize

                    1.3MB

                    MD5

                    41ea92c114193a4800fa841cc9dcf73f

                    SHA1

                    a5f551184f5d35f5c828794a3fb86c3ba0708b63

                    SHA256

                    500a5196626b082363c529b3b4f0a49555371faed2be1fcf97e8ba1d6d7100ea

                    SHA512

                    fc7e40532e38e0a8b95d703a17c56046aca33c381e9a07e7b1a9e0b777c87dfec0912afa251c7f03cbbf3b9562bd0f566c1e2e5d5d827fbf7c1115d626c5e80b

                  • C:\Windows\system32\fxssvc.exe

                    Filesize

                    1.2MB

                    MD5

                    b9b6e79de03d83ab91531957ea9f127d

                    SHA1

                    14d2e0ebdf5fadab1e3b29abb6ccc5b545466bc0

                    SHA256

                    7129db660806b93c2f61169a77d9c76258804811710d8163147fc2d56548a717

                    SHA512

                    d969bd5ba3bc5ccb46e3cf54868980050c15711830d9ed20bfa0327c33bbe127cf775d8fee0100a93976af1c786b82c977449de384201a80bac8740e23ef1107

                  • C:\Windows\system32\wbem\WmiApSrv.exe

                    Filesize

                    1.4MB

                    MD5

                    c75ab6c55e66475f2472e218f8fdf895

                    SHA1

                    17bfe1f59871e27f59be191204b2c92f42f86401

                    SHA256

                    82836c34bd00dd70c8dccdc63b8b7285594a9310dba8912c4ce38f36c8252ef3

                    SHA512

                    843e8cff3732947f8f1c155e82289860a7eabe45415575488322c3f85572e61f09293305e728707a93d2d60eec95d1df10e20f98f0b5e011edf3c5390e3d45e1

                  • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                    Filesize

                    1.3MB

                    MD5

                    45da077d1f59e7aca73dc3b09eaed8b9

                    SHA1

                    ed3226b868881b245e3aab535913f7cb63a0eb92

                    SHA256

                    67f4c8cc0f7af6c72ba2208af5bad0719b624366dc732af2d9a7bc7815798125

                    SHA512

                    83f0868260c2025dc9d3b2c3e708cd683d47b331fe5e28daf3271b0e5254b79492e19e3c82746eda669f944bdd5ddcd13638ed9dd283a6324ad75be6e7b7080f

                  • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                    Filesize

                    1.3MB

                    MD5

                    6b398e1c48f7811e8e8b4ff2389ff12e

                    SHA1

                    18849a91ea05b88502565478321a525f12443f8d

                    SHA256

                    e1de4548830ecdb464a0dbd6c127ab8816a858f67e2ad9d5d61e7990c0661b3e

                    SHA512

                    27f2fb1bfed89a9e2f39a2367b6861ef3e197583d27c56cbbb860f47603a2487fdb243147a98af09b1b1bc9d35b9e220a60cee5cf18eabb5dbb5bc6beb55681e

                  • \Windows\System32\Locator.exe

                    Filesize

                    1.2MB

                    MD5

                    db06089d46e165d51f46e4f339d21992

                    SHA1

                    f686bc6b710776f215e04f156eda3275df6a7b5a

                    SHA256

                    7aa25dce811954eac4a6d056f5a6d4d46e9dc562d118dded19922f825edde934

                    SHA512

                    27e88b1cffa3e3a213df6442dbeec3dd93e08a9bc8c3fb5cead4b99339bb28f9b4121635834ebd482f5c7f351c09c727885c6c335da8ed848e9c15d7632f21ba

                  • \Windows\System32\alg.exe

                    Filesize

                    1.3MB

                    MD5

                    70cf1f55a2ee5f90f50a8de9349aa8eb

                    SHA1

                    b7b58402d3b3deb80ce9ad39c464932a1696b312

                    SHA256

                    f528011cac5ffd4617126a5188abbe9594ad6be890c120418c3218426bc75843

                    SHA512

                    f557c19167058f52911ee1e7c9052c38d89955d8d0ec24e27a81003a6d8c5b8bf77a0643d99cd783c03189bd48430c2b0a0aca8fd98ae50e1d7d19d1cc99afc1

                  • \Windows\System32\ieetwcollector.exe

                    Filesize

                    1.1MB

                    MD5

                    c9f4744851067f52394c9cc5cb5188e3

                    SHA1

                    0e950e861163c4690c144f7ae17b380f2afa0be1

                    SHA256

                    53a63cf88e596f3cbb63dda30e4e741da7208431cf9f7e3966383dd2d8b3e89e

                    SHA512

                    219084ac7f99174de4adf61e546c6e7aab4cd2e3e026454fe483f70dbc03f9c2cc2971e183d58dae19519392d29aeb84b3ff86a3cac747c3b02daae5cdf9fe21

                  • \Windows\System32\msdtc.exe

                    Filesize

                    1.4MB

                    MD5

                    214b0fe92a7d9dc777ec5eddfb77ac58

                    SHA1

                    76538f1b1051ae5fac9d8181c9a42a38ae980bbe

                    SHA256

                    669d4c579f8f9cada839dcc3a95b42c0b373f4325e6c467f2098dd544e5172e2

                    SHA512

                    81a44e8a1da1cd033cc238f65167c30c237338d2b19adbff88d35bc079b771443db463a26b7f1a8b18e6adbf20d7b673ccb14c5c76c0a8d397e1b8a2fcf77708

                  • \Windows\System32\msiexec.exe

                    Filesize

                    1.2MB

                    MD5

                    f2444dc872de03d2630814ab547e3ab7

                    SHA1

                    24b12800ad3e0ae7c73457a1c4140c0f6fde42aa

                    SHA256

                    7d43d48851414f2f39a9f5c98715368c98f972010615aa4d2515dca0f096f133

                    SHA512

                    ef3f07c2744296cbd0a170265eddc6f55b2cf83c65f641446543954c2550d34189e62a29c51801baa99d48abc1708470d6d72cbe5357e8379df8bbf1d71dd958

                  • \Windows\System32\msiexec.exe

                    Filesize

                    1.2MB

                    MD5

                    1a59a674b9640aef636c9ca292d498ab

                    SHA1

                    f0b6fa2cea6eb89ce5e6c6e538831555295fdfd5

                    SHA256

                    06a4686cc867d8d8456d20f63b7b35fb52346529318324b1928342f4d4fdc3c3

                    SHA512

                    de39ec571b46bd31ec92d700d95a8d5d5d7d4cf412231d1ab729929c79ea2c4f728d21ec897445c4d23ea419e141ebacd9bd5fb0e3c683c8e76facdd2c379185

                  • \Windows\System32\snmptrap.exe

                    Filesize

                    1.2MB

                    MD5

                    cc1026f93dc0158e7a726dbbd53cd8b0

                    SHA1

                    2a5c8258b916ed27a27529109a04d10091a5aef2

                    SHA256

                    658ffe055d44d042bab492b38fa6f9a3f052e31d1e8590bd5adc3279ebb861d5

                    SHA512

                    9309c1a1cec2ec570f782506815bd061e5a5f128ba48cab1ce208c2c23225c78f6c2a6dd5aec28b2dcc5e8f743cb079f5f375cb3a36545bd57b9925e635488c9

                  • \Windows\ehome\ehsched.exe

                    Filesize

                    1.3MB

                    MD5

                    09f4a8ec1de5dcc3934b4c2327947d77

                    SHA1

                    e16280d50317d6aa9dfe340953f1ac66f2c5bc5e

                    SHA256

                    a20b6d7aa40d6f6d17a39124c9bab773578f4d8293f326d5c9dd7c7913d9063c

                    SHA512

                    5ac2cb8b5f88f9b7dad377dbf200f1cd10b5ba49ee317750ca8c68035d77f84b81596f2e20fe391c893f446faf18a2c46e59764a8cfcef203bc6788adb2e8c0a

                  • memory/268-135-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/268-123-0x00000000006E0000-0x0000000000746000-memory.dmp

                    Filesize

                    408KB

                  • memory/268-148-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/268-147-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/268-129-0x00000000006E0000-0x0000000000746000-memory.dmp

                    Filesize

                    408KB

                  • memory/820-282-0x000000002E000000-0x000000002E20C000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/1268-225-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/1268-238-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/1268-176-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/1268-171-0x00000000002E0000-0x0000000000346000-memory.dmp

                    Filesize

                    408KB

                  • memory/1356-174-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/1356-175-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/1356-162-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/1356-160-0x0000000000600000-0x0000000000666000-memory.dmp

                    Filesize

                    408KB

                  • memory/1780-248-0x0000000140000000-0x000000014020D000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/1780-254-0x0000000000450000-0x00000000004B0000-memory.dmp

                    Filesize

                    384KB

                  • memory/1824-268-0x0000000000680000-0x0000000000889000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/1824-271-0x0000000100000000-0x0000000100209000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/1824-275-0x00000000001A0000-0x0000000000200000-memory.dmp

                    Filesize

                    384KB

                  • memory/2204-72-0x0000000000400000-0x0000000000654000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/2204-0-0x0000000000400000-0x0000000000654000-memory.dmp

                    Filesize

                    2.3MB

                  • memory/2204-7-0x0000000001E30000-0x0000000001E96000-memory.dmp

                    Filesize

                    408KB

                  • memory/2204-6-0x0000000001E30000-0x0000000001E96000-memory.dmp

                    Filesize

                    408KB

                  • memory/2204-1-0x0000000001E30000-0x0000000001E96000-memory.dmp

                    Filesize

                    408KB

                  • memory/2212-273-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2212-188-0x0000000000B80000-0x0000000000BE6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2212-244-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2464-55-0x00000000000F0000-0x0000000000156000-memory.dmp

                    Filesize

                    408KB

                  • memory/2464-56-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                    Filesize

                    4KB

                  • memory/2464-57-0x00000000000F0000-0x0000000000156000-memory.dmp

                    Filesize

                    408KB

                  • memory/2464-61-0x00000000000F0000-0x0000000000156000-memory.dmp

                    Filesize

                    408KB

                  • memory/2464-89-0x0000000072660000-0x0000000072D4E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2464-92-0x0000000004DE0000-0x0000000004E20000-memory.dmp

                    Filesize

                    256KB

                  • memory/2464-94-0x0000000004CA0000-0x0000000004D5C000-memory.dmp

                    Filesize

                    752KB

                  • memory/2464-59-0x00000000000F0000-0x0000000000156000-memory.dmp

                    Filesize

                    408KB

                  • memory/2464-108-0x0000000072660000-0x0000000072D4E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2480-280-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2480-208-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2480-213-0x0000000000380000-0x00000000003E0000-memory.dmp

                    Filesize

                    384KB

                  • memory/2492-53-0x0000000000230000-0x0000000000296000-memory.dmp

                    Filesize

                    408KB

                  • memory/2492-47-0x0000000000230000-0x0000000000296000-memory.dmp

                    Filesize

                    408KB

                  • memory/2492-46-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2492-119-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2556-28-0x0000000140000000-0x00000001401F4000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2556-106-0x0000000140000000-0x00000001401F4000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2560-99-0x0000000100000000-0x00000001001FB000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2560-16-0x0000000100000000-0x00000001001FB000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2560-22-0x0000000000190000-0x00000000001F0000-memory.dmp

                    Filesize

                    384KB

                  • memory/2560-15-0x0000000000190000-0x00000000001F0000-memory.dmp

                    Filesize

                    384KB

                  • memory/2568-31-0x0000000010000000-0x00000000101F6000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2568-73-0x0000000010000000-0x00000000101F6000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2588-38-0x0000000010000000-0x00000000101FE000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2588-74-0x0000000010000000-0x00000000101FE000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2704-82-0x0000000000A60000-0x0000000000AC0000-memory.dmp

                    Filesize

                    384KB

                  • memory/2704-134-0x0000000140000000-0x000000014013C000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2704-107-0x0000000001A30000-0x0000000001A31000-memory.dmp

                    Filesize

                    4KB

                  • memory/2704-88-0x0000000000A60000-0x0000000000AC0000-memory.dmp

                    Filesize

                    384KB

                  • memory/2704-91-0x0000000140000000-0x000000014013C000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2704-105-0x0000000001990000-0x00000000019A0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2704-154-0x0000000001A30000-0x0000000001A31000-memory.dmp

                    Filesize

                    4KB

                  • memory/2704-104-0x0000000001980000-0x0000000001990000-memory.dmp

                    Filesize

                    64KB

                  • memory/2720-193-0x0000000140000000-0x0000000140237000-memory.dmp

                    Filesize

                    2.2MB

                  • memory/2720-202-0x0000000000320000-0x0000000000380000-memory.dmp

                    Filesize

                    384KB

                  • memory/2720-265-0x0000000140000000-0x0000000140237000-memory.dmp

                    Filesize

                    2.2MB

                  • memory/2768-102-0x0000000140000000-0x0000000140209000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2768-98-0x0000000000180000-0x00000000001E0000-memory.dmp

                    Filesize

                    384KB

                  • memory/2856-221-0x000000002E000000-0x000000002FE1E000-memory.dmp

                    Filesize

                    30.1MB

                  • memory/2856-227-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                  • memory/2908-113-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2908-133-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2908-132-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2908-121-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2908-118-0x0000000000730000-0x0000000000796000-memory.dmp

                    Filesize

                    408KB

                  • memory/2908-112-0x0000000000730000-0x0000000000796000-memory.dmp

                    Filesize

                    408KB

                  • memory/2976-71-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2996-267-0x0000000001000000-0x0000000001060000-memory.dmp

                    Filesize

                    384KB

                  • memory/2996-262-0x0000000140000000-0x0000000140221000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/2996-232-0x0000000140000000-0x0000000140221000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/2996-240-0x0000000001000000-0x0000000001060000-memory.dmp

                    Filesize

                    384KB

                  • memory/3020-146-0x0000000000380000-0x00000000003E6000-memory.dmp

                    Filesize

                    408KB

                  • memory/3020-149-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/3020-186-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/3020-201-0x0000000072D50000-0x000000007343E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/3020-138-0x0000000000380000-0x00000000003E6000-memory.dmp

                    Filesize

                    408KB