Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 10:59

General

  • Target

    cc598c4ffb86fe6515b9d1aa25a70440_NeikiAnalytics.exe

  • Size

    3.1MB

  • MD5

    cc598c4ffb86fe6515b9d1aa25a70440

  • SHA1

    b0062c0f12a50fb027e24ec56bfdc8aed718335d

  • SHA256

    17c0da57aab4e73976614df015860d5540f514b6e5dd6bf3004ea2fbdd3aea6f

  • SHA512

    eee3d108e3f2a848ff57c5f5e767670a337f1149cee6294b225cc84fca2834b0f4ede09be40e4ea09960d54cbaaa29d7c45a7418e816e05e3072bb0114f24030

  • SSDEEP

    49152:NFoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbX9/i3da1YS6oN:gHgNDfXQ1veFPk5FaoCRrgGUDx9/iyB

Malware Config

Signatures

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 61 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc598c4ffb86fe6515b9d1aa25a70440_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cc598c4ffb86fe6515b9d1aa25a70440_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1540
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:4240
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4732
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3464
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4664
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2624
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2724
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1540
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1212
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2744
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3936
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3148
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3848
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4108
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4036
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4588
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1732
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3308
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1804
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4728
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2728
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1256
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1716
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4552
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2160
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:4920
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
            PID:1196
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 72E8F407AAC1E860615BF540BAEE7538
            2⤵
            • Loads dropped DLL
            PID:3756

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                Filesize

                2.1MB

                MD5

                f5429cc219aafc3ed14e801e7c68617d

                SHA1

                2283711aaf0aa1084dc388171d5663485fd1ff78

                SHA256

                488d9e5ca1c18d0c0eb6672eda0b7d5142c7bf1784301148294066ba4b357f88

                SHA512

                d82197278591e2446f9a2b4c70bafe4f0999f3ea9625df168307152b5272a389e0ab792f33baabf92b1ac501cda95ec6d913d31e3a30a516c53430c4e0f5f7c8

              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                Filesize

                797KB

                MD5

                4ea89b057e8f3aa23dbe81d615127bb3

                SHA1

                3923d7dc1aa124fa9ddaa99917953f69a06505be

                SHA256

                3c57582e9e9632e21016f30eb405aad6e43a5ea5d0721e9fc35ac3e26bba9208

                SHA512

                7165a91c0be0cf28755bf9bc4f0e903b25b79468dd25acef058190f507afc109bbe23be147f09a9ce6444cb973057f604faaa9235ccd26ed0c1ad25e15b41543

              • C:\Program Files\7-Zip\7z.exe

                Filesize

                1.1MB

                MD5

                8d6fa31dc237162b1b1cd208cfe146a3

                SHA1

                b25962a1503c1d6e75f7abd24279be92d6956319

                SHA256

                80faca091fb63a9fde3a0075b58f86c53df47bfff04f058d1b253a8dc60e853d

                SHA512

                5b53fe84eb49ba566cf7f0310976080aec3dddaafe7db8f045aeb9af8adfd2cbc78c877c43c92d77b33b52975e843a1d2b3ff39f2a014bb52911b14d74efcb4b

              • C:\Program Files\7-Zip\7zFM.exe

                Filesize

                1.5MB

                MD5

                b110c21a607704d859afa3699d156581

                SHA1

                3dc5922273b403a97b26f24d5123eb62bf64aa4f

                SHA256

                2677ec30fd4680c81442762759fcc31f47dc6a43f3978a86bcc47049b215f216

                SHA512

                6c2f3c0aacc0856d7ed8e7e1648059c880bce1151e99cdc8dedcf621ab6c4823d121401a1925c25bcd1b73a643ef89e8ec9a6ae5f1a64da5fd30adafb32118fa

              • C:\Program Files\7-Zip\7zG.exe

                Filesize

                1.2MB

                MD5

                a8c3a707dd16ca1c723ae4ab89f8d43f

                SHA1

                86c2e8cde6ffae60a89a15cd84e726e2434011f6

                SHA256

                ec65e180c60df06f6a85a481cc7c01f6e81717599adc695315676940564cba75

                SHA512

                0cb37198ec643243e6893c50329a8fa0350fb4f1aa8c672a0ebe02b4bd5a6ed1d712f6d3010ec08769be50dea615495fa8ef947229847facd3910b1a932cf8c8

              • C:\Program Files\7-Zip\Uninstall.exe

                Filesize

                582KB

                MD5

                3971b7044ab2b132e691e9dc23f6bced

                SHA1

                396f1e0255d2110008e1b32418d6776817f7a769

                SHA256

                046fdadf2217ddbfdf298acc5ecf1d5d8aa83d29c48d27aff2a46989151afea4

                SHA512

                cb55f85408ce362ff4ae65105686ac60d609932d6d58c8c8bdf390c9e027662b889aea40d977c5158016d8861eb6dfde066aa57a736d3b6e6f0fdd054573cd97

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

                Filesize

                840KB

                MD5

                15f4b73e7e93ead3cee3f46c0e91d2b9

                SHA1

                df29db409dcb33674c6f8d6155f4461788446fb7

                SHA256

                eb4495eb75453fec18f2ca67eb7b6e0f87f014fe50c777aacc3d6e41720ae300

                SHA512

                1628592b0b18bb6988c6b655062bdfdd679cdf889b16eb474f0318dfd0ccbf9057c5bfcdf51fb8dc6da55b40a2cdc3d03d8d46cc3405598118c4b1d5e213bf0e

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

                Filesize

                4.6MB

                MD5

                ca107ab8c27472ec1bcd473c61c2b47e

                SHA1

                f8b22d842dd46167cd4f98c35e7716311e7c2e48

                SHA256

                5e20981a604993e6473d80d6c882f0b7587c0bba1d1e561d8c24b191a3f88825

                SHA512

                60273d287f9df173e868b398552fcb1abc42e4f6450c4ab9658fa58309291d02dcf4bcce5e9d1cc02e5df7b89b3ae5504b0130e965484da1fd937b9354fda310

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

                Filesize

                910KB

                MD5

                80e0a2acf3d5ff68b238ddb510a6a2b4

                SHA1

                4fd05bac23ec0296e3dfa167d6c8edfab7fe9bf4

                SHA256

                edd87e7edf995536b66af194922b1174823a0e0d273326d2b4c4163795c3970d

                SHA512

                cc1a636db9d18e2e8da36c38821c0d403e899ef184babbb042faf2f30bad29a1323bd4176a153debe0e39d77056a3cfd6f222e10b21efa53aa2d05e848ffa0b3

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

                Filesize

                24.0MB

                MD5

                22c20e779a33309c26239327b11014f1

                SHA1

                143d971a973ccf211a3683b982ffcaf81fcdd281

                SHA256

                99220abe93ee80dd79c3692cf5b66e470f47220f62c682dc177da483fd4eb130

                SHA512

                253cfb352170624b61cd9460daade0115f8a05dc353989bed546b40015ea0b66202c8b94f82da03682eed31bceaf50a0b702181d245353e8a3b1bd0acac3b7f6

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

                Filesize

                2.7MB

                MD5

                55c392c8a8216acbb86853b7a95b35d4

                SHA1

                98f60ff4adc7e663b254224181b9d1010fd309ac

                SHA256

                6e747a83be2d71ded0f07dc343561a351d9967f36a3bafae7a02fb7dc0fea24c

                SHA512

                07653f4bc921f02da2fc2ede21cd029412ae2bbfce3b86c2208233d94a54bf6adc5382696cd8136607e40d7ae33bf0f995696fe6c12dd6fb142ba723b120400d

              • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

                Filesize

                1.1MB

                MD5

                e746e88c2b73e7bc75e90956fd36e742

                SHA1

                d8f96687957bfa3f863931915b38821408297d7e

                SHA256

                0e8e1b20c8a1b85e55b9814b7ab8bdce857b0608238d65326438bd0fcccd9613

                SHA512

                3d3d52aaf76586045fa90b50f77156f2a9721b7d2c1f646d522b6c160a715a5f4b9bd7c95cbff674a4a0381068e0cb084597c8ebba647b9b6965948253385dc8

              • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                Filesize

                805KB

                MD5

                a766fc06cae56b7cf89e8865ce4b65e8

                SHA1

                76a84b575c1c5ad4687233faa6770edcda70c3c9

                SHA256

                b376f21184c71d878c028a2cf61502f4d09821b35cbb538ac8ac8eea71bdea83

                SHA512

                55d8cd30eb2de6a0aae9009812b6ff13ad5c8691634de0c88846f07ff383161e9238cf8d5e1a567668f6588460dc7f610d0b2e616253bb77a3a32218d721131e

              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

                Filesize

                656KB

                MD5

                ef3b3c8e4683fe9a5cba1130cc01e527

                SHA1

                284bce2922cf48e1627807053dbac4d1b703e9e1

                SHA256

                d74252eb79d39416a9d4f91acaef6eabf1a7277a87179f8a72d93f87c444c6f7

                SHA512

                5440edd9630634d20b38fa52451455b3dd0477149c747d7320e602cdf1d7c7634b0ecbcd43c985582e3e635246d7fbef9776f4a6e8aebfb36043ae782f992513

              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

                Filesize

                5.4MB

                MD5

                2c21a84d56099beee02e8218650dd553

                SHA1

                08c338dcc275963df312ed7bf93ddd3732596919

                SHA256

                cb98d9e60b6459d5bae3dc9765dbf97aed05311f5b74f2aca2f6b83978fcc146

                SHA512

                b15f5daef709182d994cdf56e8997ca9714203d9dae76e8ca0b07aeb46a779cfbeba1d2b6f963171695998c41af02981eac9e94355fc29015429ff4acaf93f4f

              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

                Filesize

                5.4MB

                MD5

                a8228ce9111c9db94c50ab03f580a5e3

                SHA1

                796fda0522a8d91fd726e03729387718d075cbf9

                SHA256

                66b7876245dde705107e5b4f02849176f3314791771c550b9b0c030b2022dbfa

                SHA512

                486fddb854d171c8fc6f5098babf92fed380456a35e12ea03406f68179e8b347f27797dcfb064fc56a8bc20836f616369b2ad104ac8072c221a35012ce1ff87e

              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

                Filesize

                2.0MB

                MD5

                2a877f689ac5935140bea0d8c2c730ce

                SHA1

                b91ebbaa418987e28b7e115410ad2ce0f466b6e1

                SHA256

                c064afd3174499b48ae044c6affb19bbbb82f17aee32658a8502db3c739d2605

                SHA512

                9590b7fcbdafb4484a8faec529a7f4b2f11c5d50a5be289f6c1ccef7075b64d87a1a70220c995d25ae2967dcb58b728a6996a73d84fc29eb079530ace2c16d6f

              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

                Filesize

                2.2MB

                MD5

                091faf6df4f0492b3e619d3aa4094683

                SHA1

                5173dbcea941bc3b3d78ab9404a0f5632150d38a

                SHA256

                d8db5c630a362e01e45ac435ca0a4213650c40c23c6072a03ee7a156319cd6b6

                SHA512

                bb1e07c4ffc3afea7428a5da44450d5e68955ec91952b6640d9d6491ff6d8e02f45679a41c1f309cb232a42be3fe38c5a33c43d4f2a789e656700af1728222c1

              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

                Filesize

                1.8MB

                MD5

                6dd702c2703eab39e1ccc34d643b780c

                SHA1

                70b1b80b227759d7fe249e40ab5645a03cf6cf69

                SHA256

                ab21cd8916a777f21d9e8b3ae516eb325d32159a6568f857eed846cbf240239d

                SHA512

                034e2eb8ffa1da00e00be3b894856fd19cdc6d9d132fd7492be0715d3cabe9c6e95e321c9a5f39f79b5aa3844b731357da0c7d29cb4b43685f1bf0706bec2bf7

              • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

                Filesize

                1.7MB

                MD5

                e1a61adf8d9b191ad2c2b7fc0c83dba2

                SHA1

                249af86528067811915dcb6f59a8c88fbbf6af73

                SHA256

                538423911ce48fd1bb9c36f08321b1866060f6a2aa33c4208634ffd081503edd

                SHA512

                27cab0470901ab9c950080e769bc28424ff051d7dfa8951c3d38b2a74098b2b0ed4b64421184a365ec65d7be693d88cf67ba02ba886d8ebf6346b591b8a9762d

              • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

                Filesize

                581KB

                MD5

                0aecbefbd28aac92943f9f0aa321ac44

                SHA1

                c848b5188cf0127dc68e1430fc918ee37d239f95

                SHA256

                ee873d4c7589389aeea3384cfc51369d2ee44d57be8f519d37b04db1951df100

                SHA512

                009af8899b22679209fe422b8707541140a327ac803e3b93a8de4ce6d193714a85b15846b8e907fb0b924ed1dfb55c3b04d79c651b3af511427e71969d58e2d3

              • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

                Filesize

                581KB

                MD5

                fb9aac63f7fdaeff0039a216de9877b0

                SHA1

                ffc0b0fc5e3f2c66ea873a867d7947812b3df392

                SHA256

                897e0b939362411bf3dd35e815d0087b94450bdf3d5f8934c28ecba7fc9490bb

                SHA512

                43010465d52f5b23600965ab61212489c97b98727873605d8a44d225a3debb89614955469ecdde39879c8948096b9faeb5748ce835b216143a59af99395724f2

              • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

                Filesize

                581KB

                MD5

                97bec4d7729ef0301e3152ac84c40ed8

                SHA1

                b97be25e094e16014d8f5325904d27d8a38e2381

                SHA256

                9e977b8aad47e72eb14bedd3287641b69c67f132ac6d89c754dfd686a389b055

                SHA512

                4d2a701ee05eac5ef01f17f5fe7893fddca27d9a7b43752276b7980fdb052998e0410b0531a244056efb5589ebfeb334a6069adb2be8b47deb135442c3c857c8

              • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

                Filesize

                601KB

                MD5

                9b0c389364faa54c05168075180c0c12

                SHA1

                54b3c5cfa3d4b1d3ea6a42dda75682b02ed19854

                SHA256

                f6dc03c1dac1270c5feb79a5f6f4cca72aa7f4e4c955f2ac4dc1ba18962d1f41

                SHA512

                969c03239b3bbabc620583679ebafda41aa444369eb64e7c6806a4ba9f540034f17e6ecb985ebe9442b44b2fdcc10e0c940ca9530bf3582089e124e34e3a945e

              • C:\Program Files\Java\jdk-1.8\bin\jar.exe

                Filesize

                581KB

                MD5

                8120117819cd527c01bdca499db603f9

                SHA1

                22a8ebeb8debde6df36e0daabd8408fc9e017f6c

                SHA256

                8f3ef4b9d769a42a98002a1db63cb868a9c5741db66282146dee6d2fc47f5b6a

                SHA512

                9fd0a487279b9d58c34bc467cca4f867fa19af230e96c1a3c732bf31b43d58933b4bc5ceb43ecd7c27a4d2820fb06e9ca4b4db5dbbd563a0237e73de7a8318d1

              • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

                Filesize

                581KB

                MD5

                c27d5d8f1ab1f1dd8d626816279c5e4a

                SHA1

                f03d7dcf3ed71fbbc852817bda35ce6abc48821f

                SHA256

                bf508c435ba67378c1d949dc0b65bd90107c92c1fee661a7c3f44443931c99b2

                SHA512

                5471b2985a645c2d80728393b588de5f410f4eef64ebb8e6606c1dd55f44c5629ad7e5282c07f31d50f250a7560ffe1b5e25b8b149f4a515915d83f4c79ceab0

              • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

                Filesize

                581KB

                MD5

                54d554295653b6fcc68243e508899dd2

                SHA1

                bb47b9d9ac2a8a819f90b0e12f49dcafcbde754f

                SHA256

                24810035c3c054cb561f4cbc8d42e4653343106a4830f7cdffef75515d9a3ff5

                SHA512

                fb37684827cdcc9580d06f5587acc4733b7663ccf8f72ddb2ea66f9f495fced13b6adb0b32e2107c99d2566955c51aaa38e6406f1966a56d1e2986b192b1d3bb

              • C:\Program Files\Windows Media Player\wmpnetwk.exe

                Filesize

                1.5MB

                MD5

                cd76ae27194f2a43c0a5a8becfd3ac2c

                SHA1

                b2152e4ff836666aabe3b0df07880e179893076e

                SHA256

                cb7f94b09e421faceda8098791d17687f0bd56c586082ffe400cbef9603efbf7

                SHA512

                8344dc826307e3f15e5ea8df33514d80ddc8963efc38dda57c523c0eadd9a6d43a5ee8e59dbf10c56d8606f3653331196ee90a0c80fa792908256da4a5ff80da

              • C:\Program Files\dotnet\dotnet.exe

                Filesize

                701KB

                MD5

                60d547f956f95489b4485ddaf79ad641

                SHA1

                78430352effff5bef35dbb3eed8b336f4cc029bb

                SHA256

                93ce4a1efa16494f72b5cade428128bd3bbe86b5dd60a1080d801eb47519c229

                SHA512

                e60e547abab9d45626829725fb3060dce899940e0a48fedf2f15e5b55705c30a157fe83be2f73727ffb98009c984ae5fdf2e07178dafffbcd8056e43691c2445

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE

                Filesize

                2.5MB

                MD5

                f031c0d2b460209b47b91c46a3d202fe

                SHA1

                95040f80b0d203e1abaec4e06e0ec0e01c507d03

                SHA256

                492826e1aacd984a00dd67a438386e4de883cc923cb1f25e265525a4cf70ed7b

                SHA512

                18840649d19c5310d274bac69010514872a554bb5ecadb4af5fa3667ad1a6bf9d644b31393edbc1b60ace6eff907c79c078f8213948cf90fa4d1529c68ccc629

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

                Filesize

                245KB

                MD5

                00d3bf1c1e82eee48fdf3361dd860e19

                SHA1

                b2f45cd2791ce178b45b06a95e7f58f298512d6d

                SHA256

                f2ce7873a39f7f8a2a2cd888a6b2f0a25f62bb3c475ee73cfe54988982ef65de

                SHA512

                cf5c06c4052b103d0a339d5535db2d8a9f069e928ee8c985f03e321b7e1977ff2f2200ad15671d6e93b9c706bea7586cd3df11fdbaaaf8c63a0ea4291431bca5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

                Filesize

                2.4MB

                MD5

                b31b234cb0f534069ba32aaaeacd7b2d

                SHA1

                d6f90459f8bdbf7e75cc85affe9b137dc5e304e2

                SHA256

                b5a652a1025f194f59e1349a1f26709d7ff7760067439b2d52d988a55d9340f0

                SHA512

                138cb14f6018d3bddd78012c5b36a591fe70d1b2b7f9d3774230639302401be57e1a4d6098c66a83c47e67138ac6dbe79f64548e4c317bb804a4e9a3ffdf94ea

              • C:\Windows\Installer\MSIA316.tmp

                Filesize

                24KB

                MD5

                7bfa56d222ecc4267e10c01462c6d0d9

                SHA1

                9b3236a45673ff3bb89df3e690784b673ae02038

                SHA256

                6eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6

                SHA512

                10cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9

              • C:\Windows\SysWOW64\perfhost.exe

                Filesize

                588KB

                MD5

                6b44ce09fd7af1eeb2831de4b9d37d72

                SHA1

                c49ea14f12fb43614ef9bebe53ef0efecc10d12f

                SHA256

                11a9ce2dbed2b4ddeb74a4100f43971732d26247c7471556bb300bd7dfc80023

                SHA512

                c6c93c5c2c144472f8c60467889b34422f4df7420c5dd77f7dd645648f096e0539aee5cf8dc0b356e86f59886460d83289ca42d575786e0983c576c1be3feb68

              • C:\Windows\System32\AgentService.exe

                Filesize

                1.7MB

                MD5

                fb6d7a647a7e4b7cdc10a1d1a3552ca5

                SHA1

                2bf19d6bb5dcb78befcebd89dc0acb19030bdd2e

                SHA256

                72ef6c7a915200a6101886f46b9ce25b1a634c955fdcf82f207ec2824d62d9d1

                SHA512

                7811ed7543c8f7cccaa2f12b99d40ef8b7925ecd5411eb2cfea8b46813b0b6a66a98f517176e02e6a32c2bfc0d4dc2b7a7b411e9c1c75145f0baa3378eaf4db6

              • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                Filesize

                659KB

                MD5

                d4dcfefe8500b1ec846b9e8284400893

                SHA1

                7dba2c2b0bca6df464997a29c0eedb929737a1ec

                SHA256

                1d2aec49708bd27d43184c77f6bcf2968d836b2e2705d05be1455cc812eff550

                SHA512

                bef412173f6a5d5c9613d41d10f4dcf3f9904bbb7e712ff1a4f6c7d6088626ee619d015a65128ba74ee14626b6bda3781cef2a8e576c619630176b0595af4c29

              • C:\Windows\System32\FXSSVC.exe

                Filesize

                1.2MB

                MD5

                01511975ab24b1e9fd9074f4c8e9210e

                SHA1

                c6b9bb4c019527e8bd2e9e19658d9941da8e9668

                SHA256

                641048c125e8c68255ce0ee09cc382efa3f1be3a2043c4aa7f83ad1753b83c5e

                SHA512

                5f1ce186998c6e450209ab18da571d7a390259ad41ceadef0d1b150b9113fccd4dbd45a7aef22feb0e260ae339213e4dfe261324035fbb90b72154260748999b

              • C:\Windows\System32\Locator.exe

                Filesize

                578KB

                MD5

                7fe87c251bcc25dd07634c0a93e7551e

                SHA1

                3949a9660cfb9c5fd10847e536abd5e68ad2e2f3

                SHA256

                5ef8fa36384c1fe0c70cca2944f32df6f5265ecf7df20a210f32d5268d80710a

                SHA512

                e56ca617b8d1e878e22c59cee70ba07b0e15314ec98d56252efea13630868022c477fe36142f8fbf49af6f5129a1872c8b1647049d734ff74a33bee062659061

              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                Filesize

                940KB

                MD5

                93f3c23b7787d4d314a6950ca47532d0

                SHA1

                abe60294a90129f3d28341bf3d2432faa767800f

                SHA256

                a3b562e938fa43130f89d81cc58f05df8b9dfbe8337732ff857face8c3178ce4

                SHA512

                8580cc51855d95567c64150b45f0b4e5371bb40cd242f26ac32fc4ea46adfc42af8ff1e5e4cb4f36c283cb3bea1d68039235c222b8c0cadd773df6c359c42d9f

              • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                Filesize

                671KB

                MD5

                252c169050cea336d9f210c13b8fd215

                SHA1

                2b08cdc18a863029c6b38ac20ada8587836d08f0

                SHA256

                e05585b72536f64014fa70efe5ccf40cb67b469a44362765e0946c58a190ad23

                SHA512

                db98264dc0ef71f574640da4e322a8f1f78e311936d3e39ff268ecae8135f6465ff0c6ffdac855ebae8ccd42df537462e9fcfcbf8eb9803f6731181b80eb794a

              • C:\Windows\System32\SearchIndexer.exe

                Filesize

                1.4MB

                MD5

                7af7b65863244144a4e3508e721eb165

                SHA1

                3c33a4b5c4b3281abbb0aabaf632e38edb21cdc3

                SHA256

                9078c722e5a3701eccf8d459a59112193e0745c2736b35622792b043c272cea8

                SHA512

                26a16fc5eb8a7921210223a30e1d3acf2e7ec95ba412c6a7ce7c60693d7584e198c2f3d6783d6561aedd2f29b285f1ba0a88f9df79b940a3383b0024fead5910

              • C:\Windows\System32\SensorDataService.exe

                Filesize

                1.8MB

                MD5

                c8c61fa108e30937dedf8848dcfe5b85

                SHA1

                0c14238ac9211402b35d4b9170b21aa8a7c9deab

                SHA256

                15a973de4d9dda2a47fb991ccd338d7ae6714bbef2bb1fc631d9fdc6f35b43a3

                SHA512

                00494d5aae82db0a1e7bb27136093289e7a9e7c0c299f07a5c8b56a8ad75b2d461b0f523f0340900aed9d94776f47e8ce38a89e5a3e551ecac77a8daf3efe38e

              • C:\Windows\System32\Spectrum.exe

                Filesize

                1.4MB

                MD5

                21dfd656f9f8fc471780745beafa5ece

                SHA1

                6d14594fe164f41c2c87f1d643ee2e3c3ff27f0a

                SHA256

                d84ccb3b3c66cd8bfa008cc3958c4b6e4a5208b6351d217505802d4618449d12

                SHA512

                6df4a2aa2e562ad47972f0a37cb60d2f285f92e2a4983316a4ea86a4663415fef390ce71befba06d7b2fda9c33757bc7d130887cc30ce8eaed8f03e37e9281c1

              • C:\Windows\System32\TieringEngineService.exe

                Filesize

                885KB

                MD5

                b927fc467043dba62ee1a53958fa3bf8

                SHA1

                9b7465f3efc35db5769452dc514ea6bdaf9ae7d3

                SHA256

                6afc42625d17ef79567665bd624d37b0b6c704b67fafe38ac76c7705126bbcc1

                SHA512

                beb697c00179609679209b5668263927b1e5a232ece642f5eff08114bdb1d76040bf9a5735291b6f55503901f7ac7f351c921e00f879cdae290af278c0aa4a50

              • C:\Windows\System32\VSSVC.exe

                Filesize

                2.0MB

                MD5

                b553301afd64eb8109b6c66e0addf9b5

                SHA1

                e404e8895e37799fb547dc7cad11a2702d559ef4

                SHA256

                41f6582f98c9c35df51050127256f0df9a609fa4e02b22fc6560244b42c8b226

                SHA512

                00de34dd4db06c9e4b69009226d634d7708aa8daeab3f77e373ec41319eab80666160b2366aa89cb8064029fbce177df475a53cad686e3affb8790a89da011be

              • C:\Windows\System32\alg.exe

                Filesize

                661KB

                MD5

                6c61c823c23887dccc0f10f59f710ca7

                SHA1

                8d9dc72790d30e503fe710d55e7ff36f592a0a91

                SHA256

                90446264dcee7bd38a2255ee4883324de758d7f5022da4bda7577ab8f66d7c5d

                SHA512

                a2eacecb33d33cfe1fc27adf94edff225bb7c26c2ab6794a65a88ffbb26d0778081227eb2c7eb56578b9388b3ef96529375f0bca765cf44ceba7a5d8985a47f1

              • C:\Windows\System32\msdtc.exe

                Filesize

                712KB

                MD5

                b03b192f6c2b082955675645dbe78f60

                SHA1

                7102b3c72decf5b584d951f760629da5f23589dc

                SHA256

                a95e498023e29e0e8def779f63bfbbef2dea55563dbb0dce2a324d7435111264

                SHA512

                201f6053afe6765ba4dfa53349ec3d7a3c7ce445e6ff32b6502db6f183e1ff848481b77174184c8d870f049c146c827930ca2c0026cf10fd89f56604de8e4ef1

              • C:\Windows\System32\msiexec.exe

                Filesize

                635KB

                MD5

                e2d2cd46525f8b43a593c161392d7d43

                SHA1

                dacd079ae48b7c06c2bf5559b3d1e2f87c3492b1

                SHA256

                c13e644573053ae9047f05772de8dad61fe59e2b5764e7c937902633ef9eb891

                SHA512

                a23cef90e83004d88f3075ed7f7f538d69acdb4866ab3de14ce279790bd159124616f43d471c5eb9bb7c90dd8e585b14fa576570b8648043f7124365bfacd9aa

              • C:\Windows\System32\snmptrap.exe

                Filesize

                584KB

                MD5

                ffa373f9719322065e7f16b8cda6e5af

                SHA1

                4f595d3aae677fd706bbad26701ad774afa179f7

                SHA256

                9d8d9c47d3c3b82da6f75721a6ff9fb11ee9aafea7e7e7b8dc4b7f7bd73bedd4

                SHA512

                7cb591b677b8ba6443eddf421655228f604e7443fe163fbcb104de3753788fd1395283095d2eeb7b4a5ef544c9243dee2c2436fb4a7c47fb753f3d2eec3bbd9b

              • C:\Windows\System32\vds.exe

                Filesize

                1.3MB

                MD5

                9dca74865911ee88fbd0d95472fc3e47

                SHA1

                ef658f68cb466c09e67096ed9c1496162721d59b

                SHA256

                37d866f87c6328ad2a521a5f5a34d9379d89bc495b50c4b3cc681b04e6ce578e

                SHA512

                ce5e9e76e836843150ac7660832cba510c35a6885ac7d65da8b06c51845825617d3251827d67e5bd5be6d0dc5e627b599718f73095e6084aca57030219640fa8

              • C:\Windows\System32\wbem\WmiApSrv.exe

                Filesize

                772KB

                MD5

                94e40d76baff955ed684e2dd208b4303

                SHA1

                32bdedea2abcae69c3301078e603a6a242b0d394

                SHA256

                6e486274294b9776823ac1d3068cfbbf9adcb69d04216772b16bab24b01df413

                SHA512

                351534a61743cc6fdfdf3ee16ff30e054c8a803d939b417a1a041203f7eb31dfd4857b3fe47ba1010e2ad0a8f8ec352b30372af45c30f62798d4e32e7313deca

              • C:\Windows\System32\wbengine.exe

                Filesize

                2.1MB

                MD5

                6671e32540ea65ecf5c0d50891c2bfb1

                SHA1

                ef212f2b92248b7403234835a67c6712c3a71558

                SHA256

                40143a24ecb4a72f45278128383058a3758cc27a03428ae48a4e2eae6138306b

                SHA512

                69799bdb9c5aa56f0deed370be29d4b4992972db76727234ff4159cdbad6099b9dbe69d3a3b9b8cb8dca4a4beac33b1f4ceb095a9e546e8f069084e022f7e4dc

              • C:\Windows\system32\AppVClient.exe

                Filesize

                1.3MB

                MD5

                5cee57967f8d2d0bbe567582d6e10826

                SHA1

                1d47034d2058226154023c2fab2160ecd1b5b7e8

                SHA256

                3aca866e65fcf9749e666f92da91baa1cc9138ee60c390bd4f9bbd72eadfcaf4

                SHA512

                2bab4923b90f0b3a64b7a1fb7775ca6155905beda1d482b45c6d96ede3e072b6ab7d13ed79e1aa83de55c9ca0f544e3ec8b1dcbf67fc2ca0c5c92e74c6bf10df

              • C:\Windows\system32\SgrmBroker.exe

                Filesize

                877KB

                MD5

                848639556cf9c844f0e12222d200f34d

                SHA1

                14754f3bcf4ec4a7197e2b92a03224e1778a6131

                SHA256

                e407b53c9b263f99d92a0ce8e9d12585fbe427867358d04490a8becd14420f7a

                SHA512

                fd534441a8e0a3d4b2b851a6e38299b66ee8fb81d416dee7efcf0103d6caed8dd2501138f153be86d1fbf31ef5cfe6dc7f4e4460c661ee4e8138ba4555a4487a

              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                Filesize

                23.7MB

                MD5

                d5a00f7db6050da8ae4c2479d91521a3

                SHA1

                f292bfc17312178cc2b7621401f40eb84032669d

                SHA256

                01e7b47ee5280a0f1df160b2d823857793410be6c999e89de6c5362e9f97273d

                SHA512

                32d052ceb707f6d41bdd018f03bb52fae535382463922025bc89702f935e4c9f36762a7a554b1970341e84b73a3871d39087ad5420e245d71d5cc3c2782582a2

              • \??\Volume{8a2a71c9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4c34e9c7-33e9-4a73-84f8-f7ea1f1319f1}_OnDiskSnapshotProp

                Filesize

                6KB

                MD5

                e206e030da0345b3b39eaa27cb953762

                SHA1

                a70b90bcd86d3dc450a58db89395f37360edb130

                SHA256

                e1570d974f7b192dbf9de58ab77e72e53fc5187a3df3556100fa2e0769936827

                SHA512

                567f3fd137b60e85d622f05abc191da83a09edf94575de54b76699baaa3430c919a1edfe5e203a85d23d5bc9907cf93ff22a887b3cebb009ca26cd583d3bfe0d

              • memory/1212-210-0x0000000140000000-0x00000001400B9000-memory.dmp

                Filesize

                740KB

              • memory/1212-89-0x0000000140000000-0x00000001400B9000-memory.dmp

                Filesize

                740KB

              • memory/1212-90-0x0000000000710000-0x0000000000770000-memory.dmp

                Filesize

                384KB

              • memory/1256-559-0x0000000140000000-0x00000001401FC000-memory.dmp

                Filesize

                2.0MB

              • memory/1256-238-0x0000000140000000-0x00000001401FC000-memory.dmp

                Filesize

                2.0MB

              • memory/1540-87-0x0000000140000000-0x00000001400CF000-memory.dmp

                Filesize

                828KB

              • memory/1540-85-0x00000000015E0000-0x0000000001640000-memory.dmp

                Filesize

                384KB

              • memory/1540-74-0x00000000015E0000-0x0000000001640000-memory.dmp

                Filesize

                384KB

              • memory/1540-82-0x0000000140000000-0x00000001400CF000-memory.dmp

                Filesize

                828KB

              • memory/1540-81-0x00000000015E0000-0x0000000001640000-memory.dmp

                Filesize

                384KB

              • memory/1716-261-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/1732-498-0x0000000140000000-0x0000000140102000-memory.dmp

                Filesize

                1.0MB

              • memory/1732-188-0x0000000140000000-0x0000000140102000-memory.dmp

                Filesize

                1.0MB

              • memory/1804-531-0x0000000140000000-0x00000001400E2000-memory.dmp

                Filesize

                904KB

              • memory/1804-199-0x0000000140000000-0x00000001400E2000-memory.dmp

                Filesize

                904KB

              • memory/2524-605-0x0000000140000000-0x0000000140179000-memory.dmp

                Filesize

                1.5MB

              • memory/2524-270-0x0000000140000000-0x0000000140179000-memory.dmp

                Filesize

                1.5MB

              • memory/2624-52-0x0000000140000000-0x000000014024B000-memory.dmp

                Filesize

                2.3MB

              • memory/2624-166-0x0000000140000000-0x000000014024B000-memory.dmp

                Filesize

                2.3MB

              • memory/2624-59-0x0000000000C60000-0x0000000000CC0000-memory.dmp

                Filesize

                384KB

              • memory/2624-53-0x0000000000C60000-0x0000000000CC0000-memory.dmp

                Filesize

                384KB

              • memory/2724-63-0x00000000001A0000-0x0000000000200000-memory.dmp

                Filesize

                384KB

              • memory/2724-69-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

              • memory/2724-70-0x00000000001A0000-0x0000000000200000-memory.dmp

                Filesize

                384KB

              • memory/2724-179-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

              • memory/2728-227-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/2728-537-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/2744-226-0x0000000140000000-0x00000001400CF000-memory.dmp

                Filesize

                828KB

              • memory/2744-102-0x0000000140000000-0x00000001400CF000-memory.dmp

                Filesize

                828KB

              • memory/3148-128-0x0000000000400000-0x0000000000497000-memory.dmp

                Filesize

                604KB

              • memory/3148-260-0x0000000000400000-0x0000000000497000-memory.dmp

                Filesize

                604KB

              • memory/3848-269-0x0000000140000000-0x0000000140095000-memory.dmp

                Filesize

                596KB

              • memory/3848-132-0x0000000140000000-0x0000000140095000-memory.dmp

                Filesize

                596KB

              • memory/3936-237-0x0000000140000000-0x00000001400AB000-memory.dmp

                Filesize

                684KB

              • memory/3936-116-0x0000000140000000-0x00000001400AB000-memory.dmp

                Filesize

                684KB

              • memory/4036-155-0x0000000140000000-0x0000000140096000-memory.dmp

                Filesize

                600KB

              • memory/4036-478-0x0000000140000000-0x0000000140096000-memory.dmp

                Filesize

                600KB

              • memory/4108-497-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4108-143-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4108-435-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4240-20-0x0000000000550000-0x00000000005B0000-memory.dmp

                Filesize

                384KB

              • memory/4240-127-0x0000000140000000-0x00000001400AA000-memory.dmp

                Filesize

                680KB

              • memory/4240-18-0x0000000140000000-0x00000001400AA000-memory.dmp

                Filesize

                680KB

              • memory/4240-19-0x0000000000550000-0x00000000005B0000-memory.dmp

                Filesize

                384KB

              • memory/4240-12-0x0000000000550000-0x00000000005B0000-memory.dmp

                Filesize

                384KB

              • memory/4552-262-0x0000000140000000-0x00000001400C6000-memory.dmp

                Filesize

                792KB

              • memory/4552-561-0x0000000140000000-0x00000001400C6000-memory.dmp

                Filesize

                792KB

              • memory/4588-175-0x0000000140000000-0x0000000140169000-memory.dmp

                Filesize

                1.4MB

              • memory/4588-491-0x0000000140000000-0x0000000140169000-memory.dmp

                Filesize

                1.4MB

              • memory/4616-692-0x0000000140000000-0x00000001400A5000-memory.dmp

                Filesize

                660KB

              • memory/4616-479-0x0000000140000000-0x00000001400A5000-memory.dmp

                Filesize

                660KB

              • memory/4664-46-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

              • memory/4664-38-0x0000000000EB0000-0x0000000000F10000-memory.dmp

                Filesize

                384KB

              • memory/4664-49-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

              • memory/4664-47-0x0000000000EB0000-0x0000000000F10000-memory.dmp

                Filesize

                384KB

              • memory/4664-44-0x0000000000EB0000-0x0000000000F10000-memory.dmp

                Filesize

                384KB

              • memory/4728-211-0x0000000140000000-0x00000001401C0000-memory.dmp

                Filesize

                1.8MB

              • memory/4728-215-0x0000000140000000-0x00000001401C0000-memory.dmp

                Filesize

                1.8MB

              • memory/4732-36-0x0000000000730000-0x0000000000790000-memory.dmp

                Filesize

                384KB

              • memory/4732-28-0x0000000000730000-0x0000000000790000-memory.dmp

                Filesize

                384KB

              • memory/4732-26-0x0000000140000000-0x00000001400A9000-memory.dmp

                Filesize

                676KB

              • memory/4732-131-0x0000000140000000-0x00000001400A9000-memory.dmp

                Filesize

                676KB

              • memory/4916-0-0x0000000001000000-0x0000000001320000-memory.dmp

                Filesize

                3.1MB

              • memory/4916-101-0x0000000001000000-0x0000000001320000-memory.dmp

                Filesize

                3.1MB

              • memory/4916-6-0x0000000000A60000-0x0000000000AC7000-memory.dmp

                Filesize

                412KB

              • memory/4916-7-0x0000000000A60000-0x0000000000AC7000-memory.dmp

                Filesize

                412KB

              • memory/4916-1-0x0000000000A60000-0x0000000000AC7000-memory.dmp

                Filesize

                412KB

              • memory/4916-664-0x0000000001000000-0x0000000001320000-memory.dmp

                Filesize

                3.1MB