Overview

overview

7

Static

static

3

72b9237237...48.exe

windows7-x64

7

72b9237237...48.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 10:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72b92372377fcdac6ef322494db967a3c40f638c9596ed3ec85613788b281c48.exe

  • Size

    1.8MB

  • MD5

    7376e2a7ece8bc2d4df062c2eff4c1aa

  • SHA1

    f25b27172fe7f9e4bb78d25d76a63216ac45349c

  • SHA256

    72b92372377fcdac6ef322494db967a3c40f638c9596ed3ec85613788b281c48

  • SHA512

    82dd77693b015673f6ec68cee9657aec11ca947f8c4f608c8eb2a1570d0f080fa5edfe03eeedeb214eb2305971bca98d444a9ed05f2b2b283a3f51c8550fa62c

  • SSDEEP

    49152:uKJ0WR7AFPyyiSruXKpk3WFDL9zxnStblI7a8K2mFhbrr:uKlBAFPydSS6W6X9lnMlI7K2mF9

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 25 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\72b92372377fcdac6ef322494db967a3c40f638c9596ed3ec85613788b281c48.exe
    "C:\Users\Admin\AppData\Local\Temp\72b92372377fcdac6ef322494db967a3c40f638c9596ed3ec85613788b281c48.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2232
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3012
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2164
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2152
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:296
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1568
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1384
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 254 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1740
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 244 -NGENProcess 240 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 244 -NGENProcess 1dc -Pipe 1f8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 244 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2512
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 274 -NGENProcess 27c -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2096
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 278 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2440
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 284 -NGENProcess 268 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1596
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 284 -NGENProcess 27c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 27c -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 1e0 -NGENProcess 1dc -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1e0 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2484
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1e0 -NGENProcess 278 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 1e0 -NGENProcess 278 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 284 -NGENProcess 1ac -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 24c -NGENProcess 184 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1e0 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 29c -NGENProcess 184 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 270 -NGENProcess 27c -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2516
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2a4 -NGENProcess 274 -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2a4 -NGENProcess 270 -Pipe 184 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2b0 -NGENProcess 274 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2312
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1336
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:800
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 1f0 -NGENProcess 1c0 -Pipe 1b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1460
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 250 -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1792
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 240 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2420
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 244 -NGENProcess 260 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2096
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 258 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2532
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 264 -NGENProcess 21c -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1628
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 270 -NGENProcess 1c0 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2620
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 250 -NGENProcess 278 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:888
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 27c -NGENProcess 1c0 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1592
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 274 -NGENProcess 280 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1584
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 258 -NGENProcess 284 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2624
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 1c0 -NGENProcess 288 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
        PID:1612
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 28c -NGENProcess 284 -Pipe 270 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1728
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 21c -NGENProcess 294 -Pipe 1c0 -Comment "NGen Worker Process"
        2⤵
          PID:1568
      • C:\Windows\ehome\ehRecvr.exe
        C:\Windows\ehome\ehRecvr.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:3028
      • C:\Windows\ehome\ehsched.exe
        C:\Windows\ehome\ehsched.exe
        1⤵
        • Executes dropped EXE
        PID:2892
      • C:\Windows\system32\dllhost.exe
        C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
        1⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2572
      • C:\Windows\eHome\EhTray.exe
        "C:\Windows\eHome\EhTray.exe" /nav:-2
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2588
      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2468
      • C:\Windows\ehome\ehRec.exe
        C:\Windows\ehome\ehRec.exe -Embedding
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2436
      • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        PID:1040
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:584
      • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:1832
      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1648
      • C:\Windows\system32\IEEtwCollector.exe
        C:\Windows\system32\IEEtwCollector.exe /V
        1⤵
        • Executes dropped EXE
        PID:1404
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:2056
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        PID:2944
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:2872
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:2716
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1004
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:584
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2348
      • C:\Program Files\Windows Media Player\wmpnetwk.exe
        "C:\Program Files\Windows Media Player\wmpnetwk.exe"
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1658372521-4246568289-2509113762-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1658372521-4246568289-2509113762-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2504
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
          2⤵
            PID:856

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
          Filesize

          706KB

          MD5

          cca4244e12083fc4153b275901ad5d66

          SHA1

          391028df50a7be1d1dfc14ef0d39f7ba5f8652aa

          SHA256

          50df87a44a8ac2775a13fc015eb3aaeda9e78e96113475332288c9d5d4d6abfc

          SHA512

          a999e61e345e6108c57ce2a4d5259ced8711409c4bcaa639d9a740cba96580fab2df52853abd59c29d70a70363ba374b9e102ca866019381571ffea731cfb1a2

          Download Submit

        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
          Filesize

          30.1MB

          MD5

          ce3250bf2a6f7983e61f0eafdd639682

          SHA1

          a5c8a0deb220582efcae6c999732c6b6c6e13bdc

          SHA256

          c62b80725e79893fa720b5e82e0481596ed261405a6290ee923f98fe97aa8723

          SHA512

          763bf10ed758a5acf8ddd4fedde4ca04f1d6cbe8aa466e145c7d1d237f7baa811c0ab80df3bcf2438d3f4c1895adac10bedb8c34950b9205ddfef7b41a62554e

          Download Submit

        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          Filesize

          781KB

          MD5

          f81523b0f7e2f5d10420ed777258fa79

          SHA1

          dc6ea608879712dad0bf0f8e9e37690784c1ef52

          SHA256

          4c03cd52327ee97b56baab1d745bcfa962f49b4010efb59d9e7b4d7a8131c221

          SHA512

          ccbc28e8b0794b71666969202d31c8a7fbfe448cd5705d8b28b836fe9a2ff1ccf6e13c2e535c0dc713e4f79c0d173e0f49fd27ee46814956938e6ba55191d46f

          Download Submit

        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
          Filesize

          5.2MB

          MD5

          db880da3a770b84904f36c4275976e2b

          SHA1

          f1336c454f031db9d783b8a24b8b7f8a6ea2d50b

          SHA256

          f977fca1258d6d4b3c87073f41a3b8c262c7946b2aa9a159c0bb8ab0a95f7918

          SHA512

          8fb523b8a045aca9d12f46476c33b4f1986e8f19232482ca0ed919235dcf09484754dfe7928d306ca9a9af1a9d536faa94e88e0342858ea5d5ddf0935dc46aa6

          Download Submit

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
          Filesize

          2.1MB

          MD5

          d3d4d384d2b2392619122a40c93fa32a

          SHA1

          83670f87900def5ccd74ae12d573a5acbd07adbf

          SHA256

          0512ae113aae9e6751316873fb5374e1ad449b3f5bc07aab354ed0ebe4330b11

          SHA512

          7d66066f5b2a72941d450d624a68978818e4f39957f8b071e5ce4653363d5a30d6b1e818fe621cd6a97f12e4ffc8638ce6eff1d530d5f9ab9f3b37c055261fb0

          Download Submit

        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
          Filesize

          1024KB

          MD5

          0b3a7eb6c9f30115d74e509f2e72821e

          SHA1

          9a1e5718d56ccad808b035f7b54f4b67a3d1ee55

          SHA256

          5aee9b507e4d46dafcb19ef04466e04aead79b3811b78f90dd5358eb677f9499

          SHA512

          33846ae0ddd896d55080a13461766b7714685d25e6b9c9db4dd4ced080d61d62d7ea8fb349bb2054e957421413c137dff7edc7f96d50e3ee769c8366b554c171

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
          Filesize

          24B

          MD5

          b9bd716de6739e51c620f2086f9c31e4

          SHA1

          9733d94607a3cba277e567af584510edd9febf62

          SHA256

          7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

          SHA512

          cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

          Download Submit

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
          Filesize

          872KB

          MD5

          48ea4f1673c75f9e22f0e87a88a1bdbf

          SHA1

          2c0268dea20b4041f4aae40624b979c8570230d2

          SHA256

          d5ac1a96c1ef81e6774429b0b5254ecef912a12b538860cbc34fe74014405f45

          SHA512

          39d898ce180bdcdb0a3eaba0b4f5fe16da12267aae60f712cdb88485ecfb2418e46ead68255ed9c076ff973ed7baa694be019544aac63736d402d6bb95fbf1f8

          Download Submit

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          Filesize

          678KB

          MD5

          3fe52fd0c48bc0051542415368cb24fa

          SHA1

          f58de3914b79a749c63aaa90cb0d4f90673fc1af

          SHA256

          d4e1acdbd18403b781238a3f4644ca7cd01502a4fede5ac7f3d4d113f75acc4e

          SHA512

          341dff4fe0bdaccd5e54ad988cc543a42a4e012481c7c18f830ad0349674eadc329bbe29dc4737912177d3789c0cafaa25bcee65cd17afed63b059bc18753505

          Download Submit

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
          Filesize

          8KB

          MD5

          29ddc72e7ecf36b24fee7456f213ca77

          SHA1

          16019346ff9884e7d343dd73c20574c297e93a61

          SHA256

          305e2e1095c5ee5d43288a40ad24cbceba17fb315a9b2efb59191db8cc36e659

          SHA512

          3b064ec3f71d4cc960ab0d588ecb3e269b1799fae0f5ffdc3cd1fef476befea07f9ab7fa4effa39cb2dab648f8cb13e80634c30e1481160624694e9ceab364cf

          Download Submit

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
          Filesize

          625KB

          MD5

          8b071c87e0b6aa2e241d88bcbfe8ab8f

          SHA1

          eea4f0d5672ed7aa0b0481c024d30324fbc4cbaf

          SHA256

          3bb83f4143c1922ab811029c0c6d5f92e1c01fcd55fb799e0939916e0a53fa7c

          SHA512

          4377f081972cc8649aa161660e49a45cd368ee5c2994d4ee8b9664e8dd5eefa6fcd3ea06890461dc280ffa6613277d4cde50effbcdf6a41b941d2cf56191929d

          Download Submit

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
          Filesize

          1003KB

          MD5

          9255800d0ff758bd3db5e0fcbcd178e6

          SHA1

          d975cd7de6b975824793d3ff51c5fb2cd358149d

          SHA256

          48693c4dce68f0b51cf559d81395e14bae681c73f411ac3e495c04fa217e015c

          SHA512

          e8227035651c5438cbdd8c2571e41221209ceeb84c5bd285362fb984b484dc513298bc676a04f0253f71ea18314d8ab4e54847955b0ba29b6d67d8d48d607730

          Download Submit

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          Filesize

          656KB

          MD5

          d571bbf3777930c696e622db20a706ba

          SHA1

          d9857c1ce530d38222b29e08370d5c4afe07af2d

          SHA256

          4b6b8d719c2ff9dd63016eca16c23bb765345cbf26eefce4d74f3f3b034b76ef

          SHA512

          67ff79c767a79a3e1260ef8c2032b43a9ef2cf2fd82cfbcd9e399e576ae771a306ce16b9138e3f620fb501aaa43d2f4156920d25d09d6ad1985fdb664597d266

          Download Submit

        • C:\Windows\SysWOW64\perfhost.exe
          Filesize

          587KB

          MD5

          7379b201740668bf83203a3d3787e61a

          SHA1

          4a29993215cb01cc64277ee8436335625b3cd8b5

          SHA256

          b8651a22bf9ce241d3cfb93e40b98567054f7a6a25c5bb9ba4b929c1730fa8b2

          SHA512

          b78d500b51841428e03212cb1bdf3070f336861aa884d7f1fdd3ee095d9059363e996ffc8d3020a57901f48f598ded4e355cdc4462a9d9b40ac67ddc2fe0a895

          Download Submit

        • C:\Windows\System32\Locator.exe
          Filesize

          577KB

          MD5

          998a916a0d5620e37776b4f9462166ae

          SHA1

          28e7f76c1092ed62e454112e63ba613f3e7c8f96

          SHA256

          31bc3050d66444e5e615d5e705dd8f9d38051b6a90f2d1841a3c49b4f6009f3e

          SHA512

          cd1ab04355734b9495c3a0076500c9193ca1e42567cf12b7a7057db166c7ffda489c503b4361e7eb3ddd4be8b027339cf5ba76434425291d75816c921ecd94d5

          Download Submit

        • C:\Windows\System32\dllhost.exe
          Filesize

          577KB

          MD5

          2b2789b44d26f7a5ba259922946a93a4

          SHA1

          19bffc64c738414cb6591c186be67e6eb81b246c

          SHA256

          0de562ac5b26b59c27f7c7bf23a063390e3ec579d0a76836dee0fc4e5dc2fe9e

          SHA512

          0e970a25242c6e9367f2bd36afcf471dc42931c73bea64319813a5e9ebba85b74a59a0020dab229a0f07215dc151cecff678a0f75e107a8101eab124ba63116c

          Download Submit

        • C:\Windows\System32\ieetwcollector.exe
          Filesize

          674KB

          MD5

          0bfbfc98408166a06293a118f14582d9

          SHA1

          9aa5576f5bfddcbf709d576ede55c12f5b65ec73

          SHA256

          f3d2376742439d250704311ced4cdfd3df77f9f6a0f2ba1cadcb7e1ce3575806

          SHA512

          212aa4f29e9a9baebf90fe0da771eecd17ba3d339042fd6df305a06007fbb6c61aff1b5f4449b8896d06480afc3e7b91b56f4f3c54ee29b342fcd09746d20cf1

          Download Submit

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
          Filesize

          248KB

          MD5

          4bbf44ea6ee52d7af8e58ea9c0caa120

          SHA1

          f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

          SHA256

          c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

          SHA512

          c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

          Download Submit

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
          Filesize

          58KB

          MD5

          3d6987fc36386537669f2450761cdd9d

          SHA1

          7a35de593dce75d1cb6a50c68c96f200a93eb0c9

          SHA256

          34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

          SHA512

          1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

          Download Submit

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
          Filesize

          58KB

          MD5

          a8b651d9ae89d5e790ab8357edebbffe

          SHA1

          500cff2ba14e4c86c25c045a51aec8aa6e62d796

          SHA256

          1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

          SHA512

          b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

          Download Submit

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
          Filesize

          85KB

          MD5

          5180107f98e16bdca63e67e7e3169d22

          SHA1

          dd2e82756dcda2f5a82125c4d743b4349955068d

          SHA256

          d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

          SHA512

          27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

          Download Submit

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
          Filesize

          298KB

          MD5

          5fd34a21f44ccbeda1bf502aa162a96a

          SHA1

          1f3b1286c01dea47be5e65cb72956a2355e1ae5e

          SHA256

          5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

          SHA512

          58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

          Download Submit

        • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
          Filesize

          648KB

          MD5

          12cb8fdb4834dabe7a126d8c0cf76bae

          SHA1

          c5f55db9a8448a6ed90f73dc593d574a95e1514f

          SHA256

          a72f0a9ccfb36632b04a5ec4778587f390f1e481b811f895f8feb3de426c8566

          SHA512

          b8996638bf09a1978c565209aaff1499243efcfb94b12028cbccce6e3df367ef5d9ecf6dc2b5dbdaad0bb763aa0ffa09dfa85f64306ce591e8c6c04246dd6a1e

          Download Submit

        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
          Filesize

          603KB

          MD5

          e1b747a819ae31a98ee2cf6718e0686e

          SHA1

          3e45f3a8f61ffdccc988ec73f962684d75e95d42

          SHA256

          a9fa65de9d2421b66fdde533dad2915e146418ff389a724a3f56d574d714fbe9

          SHA512

          3a925cb0caa3ad1432c1dd3af6745349ee2631b2826d9551e2f53023d8e4edbb1171e576629e8d001eb2f5806151ecadc2cd0e79d5e8868bd53e044bf6f01ac9

          Download Submit

        • \Windows\System32\alg.exe
          Filesize

          644KB

          MD5

          f0f1783c96c67210245efe95a731009b

          SHA1

          263b61ec89791400ed2f9f4d8397b6afb6988124

          SHA256

          8dc86d26315f545df0aa54d9361d9bab561f419090f03e86c3232b1adb8a60f1

          SHA512

          dbd405f37f6067ed437f114ffb6569b985c463a8edf236b846d03046e27ae4e24d58a2b475464a752ea3a05eb993709e4b3e11cd9b06333aa88100bd315f87f4

          Download Submit

        • \Windows\System32\msdtc.exe
          Filesize

          705KB

          MD5

          96849c90621587753650cb9442d5e5b6

          SHA1

          8e28a3a2fc7b84b2ba385000f7322da0552d9a53

          SHA256

          a1f2d7e82eccb5f8a420be490cbb1ed268f5731eb1d4143c4d70db98c3a1d0ac

          SHA512

          8e2be084d63c5d1f5f78b602fe3c6175871a62dfffde0a3808cdd510fd743d4e08bee945dcc91a71510dda20cdc75f79b1501c5a2a7f899c240b630455dee03c

          Download Submit

        • \Windows\System32\msiexec.exe
          Filesize

          691KB

          MD5

          306cd7b5fe5d4a16b2aef3bcf0fa146e

          SHA1

          223ad024e04f94e331bc24a68366247c9828b199

          SHA256

          a9125a73adf9424a049a1a63ac011316e8a8e2f4ff8d10e4c235e8231f129911

          SHA512

          5bc323cb2c1f9514fe47927d4c111c2b8c8397ca7f7d0efd3c1faee1a729b80ac3112668e4cda73839c4b3c95914a76c68aab3b29f98378e114553d679beab8b

          Download Submit

        • \Windows\ehome\ehrecvr.exe
          Filesize

          1.2MB

          MD5

          9067fac1f3fa7f0e23d6c2fa00c6c393

          SHA1

          2772e1bbc7259ed1031736deb2434b6cd28b7313

          SHA256

          265a414419cadfbeac6c40d978f2fa4d6075a8234971c904e44485b1b0deedd5

          SHA512

          a377bcd10a7e9a30f4d6b6e773a80c9b14fb4bfb77c4d287bff3dc8344715eff7fdc02600093f71a34d0cc1f7a75d3e3022b8c02ab64657149c6dc5ca44a623e

          Download Submit

        • \Windows\ehome\ehsched.exe
          Filesize

          691KB

          MD5

          6f683aaf3653163e75a6f098d204a596

          SHA1

          961cce96c50e053bebc58bece61f82b28353fa6c

          SHA256

          4bebde7e490a9300cfd9d47b167b06672652a1b27d04bbaabbd31bb592ea093b

          SHA512

          4906549e3515bebf846794ce7d0aa013f4376862fbc59a8ff965191427a859c25f176e2d5b0d587aaddc7624269aff5178bf8b412fb50a876a3606e10657aa33

          Download Submit

        • memory/296-130-0x0000000000BC0000-0x0000000000C20000-memory.dmp

          Filesize

          384KB

          Download

        • memory/296-123-0x0000000000BC0000-0x0000000000C20000-memory.dmp

          Filesize

          384KB

          Download

        • memory/296-122-0x0000000010000000-0x00000000100A7000-memory.dmp

          Filesize

          668KB

          Download

        • memory/296-180-0x0000000010000000-0x00000000100A7000-memory.dmp

          Filesize

          668KB

          Download

        • memory/584-377-0x0000000140000000-0x00000001400CA000-memory.dmp

          Filesize

          808KB

          Download

        • memory/584-379-0x0000000000FF0000-0x0000000001050000-memory.dmp

          Filesize

          384KB

          Download

        • memory/584-367-0x0000000000FF0000-0x0000000001050000-memory.dmp

          Filesize

          384KB

          Download

        • memory/584-362-0x0000000140000000-0x00000001400CA000-memory.dmp

          Filesize

          808KB

          Download

        • memory/800-390-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

          Download

        • memory/800-353-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/800-351-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

          Download

        • memory/800-391-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/800-389-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

          Download

        • memory/800-350-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

          Download

        • memory/1040-358-0x000000002E000000-0x000000002FE1E000-memory.dmp

          Filesize

          30.1MB

          Download

        • memory/1040-352-0x00000000004C0000-0x0000000000527000-memory.dmp

          Filesize

          412KB

          Download

        • memory/1288-140-0x00000000007A0000-0x0000000000807000-memory.dmp

          Filesize

          412KB

          Download

        • memory/1288-147-0x00000000007A0000-0x0000000000807000-memory.dmp

          Filesize

          412KB

          Download

        • memory/1288-291-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

          Download

        • memory/1288-141-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

          Download

        • memory/1336-340-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

          Download

        • memory/1336-293-0x0000000000AD0000-0x0000000000B30000-memory.dmp

          Filesize

          384KB

          Download

        • memory/1336-342-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/1336-322-0x000007FEF5730000-0x000007FEF611C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/1336-341-0x0000000000AD0000-0x0000000000B30000-memory.dmp

          Filesize

          384KB

          Download

        • memory/1600-158-0x0000000000230000-0x0000000000290000-memory.dmp

          Filesize

          384KB

          Download

        • memory/1600-159-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

          Download

        • memory/1600-166-0x0000000000230000-0x0000000000290000-memory.dmp

          Filesize

          384KB

          Download

        • memory/1600-299-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

          Download

        • memory/1648-395-0x0000000100000000-0x0000000100542000-memory.dmp

          Filesize

          5.3MB

          Download

        • memory/1648-417-0x00000000741B8000-0x00000000741CD000-memory.dmp

          Filesize

          84KB

          Download

        • memory/1648-405-0x0000000000850000-0x00000000008B0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/1648-408-0x0000000100000000-0x0000000100542000-memory.dmp

          Filesize

          5.3MB

          Download

        • memory/1832-383-0x00000000005A0000-0x0000000000607000-memory.dmp

          Filesize

          412KB

          Download

        • memory/1832-375-0x000000002E000000-0x000000002E0B5000-memory.dmp

          Filesize

          724KB

          Download

        • memory/2152-114-0x0000000000290000-0x00000000002F7000-memory.dmp

          Filesize

          412KB

          Download

        • memory/2152-108-0x0000000000290000-0x00000000002F7000-memory.dmp

          Filesize

          412KB

          Download

        • memory/2152-176-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

          Download

        • memory/2152-107-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

          Download

        • memory/2164-95-0x0000000140000000-0x000000014009D000-memory.dmp

          Filesize

          628KB

          Download

        • memory/2164-103-0x0000000000A80000-0x0000000000AE0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/2164-96-0x0000000000A80000-0x0000000000AE0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/2164-183-0x0000000140000000-0x000000014009D000-memory.dmp

          Filesize

          628KB

          Download

        • memory/2232-7-0x0000000001E90000-0x0000000001EF7000-memory.dmp

          Filesize

          412KB

          Download

        • memory/2232-6-0x0000000001E90000-0x0000000001EF7000-memory.dmp

          Filesize

          412KB

          Download

        • memory/2232-295-0x0000000000400000-0x00000000005DB000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2232-1-0x0000000000400000-0x00000000005DB000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2232-0-0x0000000001E90000-0x0000000001EF7000-memory.dmp

          Filesize

          412KB

          Download

        • memory/2232-139-0x0000000000400000-0x00000000005DB000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2436-348-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2436-415-0x0000000000DF0000-0x0000000000E70000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2436-347-0x0000000000DF0000-0x0000000000E70000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2436-414-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2436-399-0x0000000000DF0000-0x0000000000E70000-memory.dmp

          Filesize

          512KB

          Download

        • memory/2436-346-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2468-355-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

          Download

        • memory/2468-349-0x00000000004A0000-0x0000000000500000-memory.dmp

          Filesize

          384KB

          Download

        • memory/2572-403-0x0000000100000000-0x0000000100095000-memory.dmp

          Filesize

          596KB

          Download

        • memory/2572-308-0x0000000000200000-0x0000000000260000-memory.dmp

          Filesize

          384KB

          Download

        • memory/2572-301-0x0000000100000000-0x0000000100095000-memory.dmp

          Filesize

          596KB

          Download

        • memory/2892-360-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

          Download

        • memory/2892-206-0x0000000000820000-0x0000000000880000-memory.dmp

          Filesize

          384KB

          Download

        • memory/2892-197-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

          Download

        • memory/3012-157-0x0000000100000000-0x00000001000A4000-memory.dmp

          Filesize

          656KB

          Download

        • memory/3012-83-0x0000000000850000-0x00000000008B0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/3012-16-0x0000000000850000-0x00000000008B0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/3012-17-0x0000000100000000-0x00000001000A4000-memory.dmp

          Filesize

          656KB

          Download

        • memory/3028-296-0x0000000001430000-0x0000000001431000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3028-192-0x0000000000270000-0x00000000002D0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/3028-184-0x0000000000270000-0x00000000002D0000-memory.dmp

          Filesize

          384KB

          Download

        • memory/3028-186-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/3028-310-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/3028-397-0x0000000001430000-0x0000000001431000-memory.dmp

          Filesize

          4KB

          Download