Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2023 14:55

General

  • Target

    Request for Quotation.exe

  • Size

    1.4MB

  • MD5

    6194f48fb37a6bb1ba0908abc6b1a537

  • SHA1

    0e80a10e34ca8b23e568f871bdc0eef8f1fe63f2

  • SHA256

    5f323f12b134d9f8718282eeb8d8423c9a6f123545cb8fb4ca3a38b6f8092af1

  • SHA512

    7723660cb65c449ffd73ce457d3c7ce93a4d7703452c7d2f68608e4245420e26fc390a435f4cf3538931d6938568266043e3600e3fe943f531ad696990f7ef25

  • SSDEEP

    24576:m9WFfD+P2kVORHUvU/C88Cx+DDs9hmt9EwONE+D3APRgbUTfNugzT:+U4C4Cx+DQU9EwqTAPRgbfYT

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Drops file in System32 directory 31 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:4652
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:2008
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2244
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1308
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3556
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1840
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4948
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2812
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1064
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2708
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3920
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4888
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:5108
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2856
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2220
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:696
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4300
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4792
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2780
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2684
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3700
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1176
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4204
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1468
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4152
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2236

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

        Filesize

        2.1MB

        MD5

        d52848b873481a89fe64d28dc87dd232

        SHA1

        0aaedfd6f528031130ac7bf2b81b6a020136ff2c

        SHA256

        7c2bca6779ab6d8612888557b929c2345d460ad05c2094bb6a77477f6648c6ee

        SHA512

        ff07ccdc8a7eae476c1328388a4bdbe81eec77d0f2182a3711463c597f1f598675da03639c63e7ef14c7351de603ed503e0bfd153a95aa4242930c5b20ff169b

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        1.4MB

        MD5

        219c626905bd86d692ca61fe0703e261

        SHA1

        03972d84bc376ed5a8c22ca29af8afaf93d57c6e

        SHA256

        c987e97eab459f798a816610c99d90e4bba9b3a49e5fe86768ebac66bdd0d50a

        SHA512

        dd5dc3095e57eed00792e656cf9e7a4c322e2876b061940df980c1a65e516a4b7bdab59199c92729ecdf452e7fd1e55fc621e6cec8cea4560833a1087fb6c759

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        1.4MB

        MD5

        219c626905bd86d692ca61fe0703e261

        SHA1

        03972d84bc376ed5a8c22ca29af8afaf93d57c6e

        SHA256

        c987e97eab459f798a816610c99d90e4bba9b3a49e5fe86768ebac66bdd0d50a

        SHA512

        dd5dc3095e57eed00792e656cf9e7a4c322e2876b061940df980c1a65e516a4b7bdab59199c92729ecdf452e7fd1e55fc621e6cec8cea4560833a1087fb6c759

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        1.7MB

        MD5

        d64c173748489324318fbb1485093549

        SHA1

        b08b5cd6c6fc9c6a817fe9381c45137f91371faa

        SHA256

        795eca1691d599163c8a5a224518fe6931e33f1a85468eaf0af63fbaaad1c294

        SHA512

        49745dc4f64e4a81ba1ddaa7947c6c38aaa65289280a3f923b77a87837463c099d4a51f354b9f7cfb39b16b134ae29d7537350ac0319572c503123494e2bc6e1

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        1.4MB

        MD5

        2a52b8d79ed9e0dab9ae5f25cd1641e6

        SHA1

        ba183e61d3fd27a18c1050a90483ba8ee201b3cd

        SHA256

        fa1adf3f0ce79ac9180ce0d831dbd29e55cfadbd55234331295b44987e037d7b

        SHA512

        78251d357c7762acf2390fa38cfd96f621b4df7e1868f150184cecb511340eba6aad472229aae217e1cf54a0562edf3991fce2577029b0acce6f9a1edb611232

      • C:\Program Files\7-Zip\7zG.exe

        Filesize

        1.1MB

        MD5

        5eed1ba6209730202f019ab3966d7567

        SHA1

        39b2d120c261f0fa2e35a576bb891fc14433f35b

        SHA256

        7685f7b2df3a7a8a7286f39afc1cdd76175e0b7e1fd81a16a90fcdd24f65d468

        SHA512

        de6cecb78d2763e4e77f161515d36443b30d9815824524deb9d5c6f95349ec898717ec4e72326b157bc2ac8cb55e863120e7a429a2fc852af66f0944f8fe2c13

      • C:\Program Files\7-Zip\Uninstall.exe

        Filesize

        1.2MB

        MD5

        576692a76c0e3b7c22025e3b6bbb4d77

        SHA1

        f0517f6f4d85bf71370e6743d9452111d04e5629

        SHA256

        51d298839e1f807d503fbca7e8a8259215c812cc2786bbdd21356ef543c7873e

        SHA512

        678627c2d8d44973927b99c9f620dcc690d0f3345cff79e9a31f36c7a2065b57b07f41986f3532463518afa02108312981684e5585768091c39c0476a946e13a

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

        Filesize

        1.5MB

        MD5

        bb0599c5a13d6a39bdc85553e2e39335

        SHA1

        31527ec0909cbac453f044f42edb79fe5a27436a

        SHA256

        e5c19a857467d0f7d0fd1d0e39aae7f6a06f5ff43a34335fb8c6e74bdca61864

        SHA512

        3cc11e705d062041be576669b7b1d45c885768350e40df7f5714627d233d235b9a63eabc1d90aede1c423440d1011e01d5ffbbad22482e9b2f844d2d53ca4aba

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

        Filesize

        4.6MB

        MD5

        907c45761c6f666f7857d536e46f9cbd

        SHA1

        5c559c4a0f2905c0e5ec71a5666fc42fdeca8f98

        SHA256

        864efd11e986c3cbd5ff10932b24b99bd565daf97fb557c00548265b59984064

        SHA512

        fe17c327b89ed1a8366c369ad1721519458a74f7e26a0fc0be6d5c2365be3382d361c972d30e873146095e49431cd8b944d84fcdb05760304ab50c65829f290c

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

        Filesize

        1.6MB

        MD5

        e45896f4fcb8e4b4e88041d31dc10f40

        SHA1

        a6a9312b3cd373b91ce857015c69812c69ad25ae

        SHA256

        cc32074958b0843988826d528cf6e1a72331d1696822512fbf1a5909a8f2f872

        SHA512

        14ae62c54b74c96dd77581666dccda11a546b1806f3fcd0614dbc2c355bee430db00135789b3b32f665acd8b8390a20df17bb3827acb0a68bf7230e9d3e9ccd8

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

        Filesize

        19.3MB

        MD5

        0078f17c5ceb79b0efd9ca0442375382

        SHA1

        37cb25c9d07073f6e2c77023d69fb6c2dfd82899

        SHA256

        fa871e2c09d0f4a9a45ab16d0faa8b3ae6c74c980abaf885598fcf9025972b09

        SHA512

        97e7606eb30781776d9c9b9544d5bc01df0727395a4e34596cb7f9202c9a77054129d6fec8a0a9807f72daa3eefaa2297edf1fd03d0dee5610bc6251bd748919

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

        Filesize

        2.7MB

        MD5

        b0810cfdef0d194818ab82bfd935c2e4

        SHA1

        1c3b9c8d4c31d89bc774ac74dabd8ea0e81c55c7

        SHA256

        bf4e9bf7f3fb8ef4462180a725d396a430cf7e2a16dbea638f8949ad85d3617f

        SHA512

        5b3b4ab76a301ca40f8b8028098fe559ae2fe68e4fba63295d54a83db08a05357f9581ad854de5de9380376cb44455185bfc060093c7faf63e81b5ec49e44989

      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

        Filesize

        1.1MB

        MD5

        6fedeb823c50a4e1d9fba4c7a16228df

        SHA1

        78badc61fa49f4b7ed08dcedc98592c53a4b8d9e

        SHA256

        1c6604d843ac039b8bc4c0ebc03a93ef875c15c7c4fb6a0a66e5c19dacfc9542

        SHA512

        e98382f425a96fb6d41bb2e7b00ceef41b0dcf343e1d283576d9d47af7d96292ba89c73d62d14baa82a38aa116a9f4df66eca2a6c7803d1c81d08c330944412c

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

        Filesize

        1.5MB

        MD5

        296b6ee091d636dc58920d75c014b201

        SHA1

        1272c4a320e7a737c0a3721dedc171e9e7f92692

        SHA256

        25207c7ea6462ea74797b2924c181f4ffe5d6215652685c432532df757a053e7

        SHA512

        845a9cd5acfb1aed6c9ea7bda8b1fcd1b4dcc3c28cb7e944573c190efc3cdbeb8637f2511021091a006d621861239b629f059bf8acee627318929ebefb407fcb

      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

        Filesize

        1.3MB

        MD5

        7c9dd73287d2b59b2bc4d936ee3d2c3a

        SHA1

        5b01b1e7c0d4a1d385d52a60a37e20dfe2ca0e3e

        SHA256

        db4c181f9403576c36d85841ba70fc0231952fefe300b42f0e3a8a2355f4ae4f

        SHA512

        582d8f775748339f6f3c7458a2fc4653c7c7a7c5ae95e30aced53826c46ea82e2e0cbfd63c6b56b085d13f928ae07d9f0c56de35886c75a9da4fe1f52b829b37

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

        Filesize

        4.8MB

        MD5

        b6cc20cdae90589b90b01242a609cbd9

        SHA1

        0d85908476b21ac4d78ff8304b59850d5bbb8a44

        SHA256

        64eef9a83a9bae6295e67209cce8406edd23e04514cbcae667dc4f2160510100

        SHA512

        b5c77d80ab80893b55f9b9241a673296276760929ca4ad01474b07498acd80df63fcad352056afe216fab06966b009abe7c01e63e2b336cdfb25cfbf69b5dd1f

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

        Filesize

        4.8MB

        MD5

        3fc422f5284a21428c6002be64fe7955

        SHA1

        cd84959aeb8d4a050355bd3a0c595942a2fbd826

        SHA256

        1f704d7ecc74a52653655980ea88d11ab69bea83b9da3fa3545cec0335d61a6f

        SHA512

        9396dd86035ec16c91d2b7106d0163f6565aa7406b38927582f85233549215d2ef688874e18c5fe88903a0a2012c126dfc5ce5a2939fd398e91c06d2b47fb4e4

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

        Filesize

        2.2MB

        MD5

        dddb633daeb7bb6848d6addf7b21b443

        SHA1

        a6f9cfaa0aad4722371e2f4904fdfb3d9ee9f6ac

        SHA256

        08fa1aa00d1d560d03c027ca089fc61f4e0d63990fd5a6c065e042d3d578f294

        SHA512

        abc1f6986ca2984357bff640522dfc3d1e20178a033d49054ccebcb06360c8819de0225ebc2eac48c6083f760998b6d28b835271d5ffaaba15f46ce458a8737b

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

        Filesize

        2.1MB

        MD5

        89cc396397546b7dc6190d7d211562d9

        SHA1

        18cb03ff671c05d9ffca8a7a66ca0a9ea28ead16

        SHA256

        1b527a82f11133caad3421d3872b67c02a3b3714080c9dcba5c99d874c648443

        SHA512

        721c8056e7139466fa92b5433c71fad1231a07dd535e7f3ed3b2dcdfae14446a4697de386b3d5d0bc2b1c753d94fc8ce945cf7a9c026b2545ee1b16e2f35cc96

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

        Filesize

        1.8MB

        MD5

        5bdb27fec4058f865f3522f1bbcbbf57

        SHA1

        56e20b1ad596241a47c5bf33411dc0d600a6451c

        SHA256

        1c29ad99e2f115885ac2a350daa46e89d283dc00d5ed99fd9dc775faf863c695

        SHA512

        9cd4de03bd16c51ea47351fd8e9fb7e52fcf87a5c1e1b2e8390013670184f795b3389bd92f021cb3d585ca066590fb54377ca7d4116101c238cf2f7bd8ab3d62

      • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

        Filesize

        1.5MB

        MD5

        ec928f732df22daa7e98f7738e3a3c87

        SHA1

        a657e7a5b774985b167fa59f7d24224d953ef8e8

        SHA256

        99f56b03cc8cdf4459ef8fce243a84e84c4546601e57f065dc58004ec98382a6

        SHA512

        b654569a41aa5012060d20d44865a6bed54b4a0e77ef92a97646b68ec25f69fbc7f2f5607ca8bf726f28108b8e7c345e8aaf56c8480b824dcff04d25ef1e5251

      • C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

        Filesize

        1.2MB

        MD5

        19a87841817bbf128d1bb8c5eb4d67d5

        SHA1

        7461845b645ba5976bca20bfaf1cacb05944b4bf

        SHA256

        dad16556e0731acbc8ad5bc8fcdce119599ff9064e6386479c5bcc533c6945b5

        SHA512

        2719d5d6f2d42b1dc4ed9457cae31a76a59494f45cb8fe6282d37c4c3709837a47e7a4744c876829713bbd3ba68201664d85495ed03a1045b85c819f14df3af0

      • C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

        Filesize

        1.2MB

        MD5

        e7fcc66792971b076a03620b03534beb

        SHA1

        5ad38923fef93b05d92523c9bcf8af89a5f42c15

        SHA256

        27973fd950c70eaaada4c88796c066e4f129531dcac7d349edd30d97f46303b3

        SHA512

        f26c186920a2ab327d538ddc844fecfa540af4e51e2ecdfc10f04d831ccc0fd28123e7549a05631fd3776e6448241dc390896c394610c911958059a854c090e7

      • C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

        Filesize

        1.2MB

        MD5

        1a0df7f5ef232ee41d6fc9da37d5c051

        SHA1

        0fc9d7ece3e0be51e9046965560faaafeb46da9d

        SHA256

        246de9170b0512c209723e845422b99a5edeb0b2f548e6a1b807bcd87370e9d7

        SHA512

        d8e190c3a7468892b9b373a4b6465afc079c4baaa32fa101a23382edf9678c3bf378a617614188f0526cc39a4b22e34e2ac6b24804cce9d70ad50a671cf4bd55

      • C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

        Filesize

        1.3MB

        MD5

        fd7e394607d3d28a59413d102965e9a1

        SHA1

        bf2e4a4a4131f0cb8241f5d0437fbf0e143cb1be

        SHA256

        ae1e8536f6f1bc48778c8e6d91bb7d04c66d6b6788d5be3d316358e9237b7433

        SHA512

        ab3e1648e36df25a28989093254e9839babbdf12e3214e682a5f3b38028d78b6820599b88d8ed2f87871bab05b4464f16890e01c06572498dede29fbfdaa0944

      • C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

        Filesize

        1.2MB

        MD5

        b5266746baacdb97f96c0e9206c7a928

        SHA1

        dc3a2a0410314dd645a2a42af3102178df7acfb1

        SHA256

        a0b9e816913b0344aa476471dfab667db358263fcaa2b8962de8124ed8e90385

        SHA512

        e1e20fe23611e2e61f5115eb09f646c5cfd563ac0f64e66cd1d5acaee6d482cbabb77715a93a354681903f41a0ccfb16c68002dba5dd887f2a46e8d8345622ab

      • C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

        Filesize

        1.2MB

        MD5

        91fe806996acdad4b8a4573d266209ec

        SHA1

        ec9f49a23f6337e261a770e759178ca9d8419ce6

        SHA256

        1aba781a5aecfb61178f758f35a814cb453f569406ac9e16213f3ca0b8d87a7d

        SHA512

        4cbe3041d5a0a6c43dbb704fafc707cafb49c2264405ad54d915509c757b8ae77b29c26bd4927909ba7351ea22d47cc9ced6a687b4608051af5089d8d6393411

      • C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

        Filesize

        1.2MB

        MD5

        41bbeea7ce35a94869f6d6c3e688ea6c

        SHA1

        ebb88774a1f5675edb5b4e61805f34464c5516d6

        SHA256

        d598ed772fbc189bbb0056950080dfd74a87906a3ccc0bef32a90367cf5abee8

        SHA512

        763a321c8b0b1544bded2900925abb53723cb914c6ffaf70b0e29c08bddde458e536045f0a2a35da2d3773fbd41c2d1dfca78dde37ce0b1a4979c94a2908cef3

      • C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

        Filesize

        1.4MB

        MD5

        b5bd3b6a8f75e3450ce026dbd02aecd0

        SHA1

        3d4620dbf161e1be9f79d4d7dd5701ba7a21813f

        SHA256

        cc8c7a98d539f1ccf073d459a7e2b10093a47af375646fd0bfb4a91b95db5f4b

        SHA512

        90d69ebdf6a484210daffbfaca190a4d08cb3e6d959b2d3a75e01def584d46ac97a478328b994bf2f7a168fdc5494df94c34ca8c528ca8b931c37afc9a35a352

      • C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

        Filesize

        1.2MB

        MD5

        d3fbe1a2a5eadb4e5032e308bd11ee13

        SHA1

        62d79e24a22bda3ae97094fca679706d0219c768

        SHA256

        a69cecb8de4ee644a245c0cf1bb3b8ce8868ee5dfae2b5c23d6ff899fb80922b

        SHA512

        fe0c9df677f5d7e1b4436262c196994ab105705b41cc4f383a44c1f5c9cd87386347624670c983c39259415642092249ca74062f9e9176d5f5dca40a9e158ba6

      • C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

        Filesize

        1.2MB

        MD5

        b597d561a28aa7233642c4a2e9417849

        SHA1

        62f29519cfd2e5fe5a969eeb668d2894bef5bf35

        SHA256

        6e28e3e01b735ce83b2c66a9233a1617ffcca35bc7edfef3ebdc568adbbda714

        SHA512

        e70c2d911b476eeafff8cc1e5dd9c1ecd8322b886570602ff58486e21e3e98bf1d3a448f837e11c9cc6939390f712a120f6b466b6f6f9cd6d6342cf1d52a1ce9

      • C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

        Filesize

        1.3MB

        MD5

        ae330e6a96025c52b1bb93eab0b443cc

        SHA1

        e884b278c7ac699362d81c20b100f0da94016728

        SHA256

        bc4168bb5922acf44ca6da342013c41bc00cf7a246a42b19d68513459c8b1088

        SHA512

        30e2035b7b5249c635bcde31fb69676d62f57a20d470c8306dbe01e2ce5d81e1b953daf369a5dd6e5a974cdb9af7262ad1dbb82dd326bb3e364534630a33bcd4

      • C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

        Filesize

        1.2MB

        MD5

        2ed75e53fbe108da20d183356b8d2601

        SHA1

        d6277ee9ea851067b311c96617eeb79013f3d595

        SHA256

        04613903114c06d0496f8a84c37f18505f478dee204fa357bf6015e6493d378f

        SHA512

        669f30b1456171b8bbf953334fc698fac4684671df438eed3bcd368bc84c57f845bb9e5888a99533754b09d917d61ea11beecc5bcea532e0179d993da96d7c3c

      • C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

        Filesize

        1.2MB

        MD5

        a58ce75c0dbe31070bce524b95ffd6a6

        SHA1

        654f32a77e9ab7d4874b01d3359fc5789d95d847

        SHA256

        de8e70fef3e833ba43a59c0880c53d983da866e406b1480e8e3e1214696efb17

        SHA512

        b96e0174d10c39e5944c24a388bc5033714c66a925b11593166e29c1f099a1ffb0a65f985c5587c08e03621c0f05fa5011dd9c2150c6a247b0fc939a13df0893

      • C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

        Filesize

        1.3MB

        MD5

        e07d6ecff5638e89af8cde38d5fce7f9

        SHA1

        f51ccd512863bd5a0c1ff3a9e4cc1881e896a459

        SHA256

        225083885bd8bc180eb2fee04c422ca01da045d338c9d3ccf62b80f1c18cda19

        SHA512

        be8d59e4c91409d5f8c4e05dde27909c91ddd0258b8c97bef034cd5e062ba25b36845de3e2475de48a0d8ba8bfc5ec0e1a3982bff5188a58700f5b7ccc9313e5

      • C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

        Filesize

        1.4MB

        MD5

        4aeb37efa386c198d7cdd6574b23d4b1

        SHA1

        849125f335bd31038d9688410e2006b053554041

        SHA256

        c5fcabe9ac33bdafac64e102366f5afc12cfb27e2056cb4f411eab569080054e

        SHA512

        7aa17abe51b94ec965ede6c760ccf6284d358304c02d5fe5d5607bdf131614fd8e19a31c14d4999e031e26e04e6d9caaf4294d98385522b4b8b041bff2359d99

      • C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

        Filesize

        1.5MB

        MD5

        ab8ec25806081b3368a54207236b8037

        SHA1

        d0d79f4048d2b9b9c71e272da94167f76431cead

        SHA256

        62397606a86554d5a6d10d4e0e6477af5b0c5900e01bd592c4c42a215cb03d09

        SHA512

        273e7a46feb453e30d63226f84557e61ace4c798cd68a677b5e44be6c9072e101ba9a25767d3053690190f6742fc4aa83dacd643f04e2ab20b95db5114167716

      • C:\Program Files\Windows Media Player\wmpnetwk.exe

        Filesize

        1.5MB

        MD5

        cd2e0d6284d42ddc1dbc7177b8b6be21

        SHA1

        09aff829ddcf0ff33e2762e10fecd8978bf24798

        SHA256

        2e81b02390c0e271112e769e2bb46e263a2147e247f7dd5da29c10ea060885b4

        SHA512

        523b12802ce8f7ad7ef85189f7f3aac3238e65cb57764828e91d3860e835a925dbd70850fff46c024d9e82838254e14f474ac75a406323ece33454ff8bf13fa6

      • C:\Windows\SysWOW64\perfhost.exe

        Filesize

        1.2MB

        MD5

        1be9dc32db3f77fde97a0e6c77b345aa

        SHA1

        0f2f2b32e6628b34d97e69d7866a355060398261

        SHA256

        95446d475a6b377848b67e6e7d523dde3a5de4108cfb4efabfff426c18602c0f

        SHA512

        92e095c6de1d09f34c7d31461e6d82e16c0f3f4feb503e60620d85b0de7d6f78701e19404ee3a0b17e462874874695d9d357f24acf1383bd01ede5ed38d7c0e8

      • C:\Windows\System32\AgentService.exe

        Filesize

        1.7MB

        MD5

        6394db6f0fa52175225a417cba787c35

        SHA1

        7ad6d3f6e4612c158eabbc6bcf78ce5093695956

        SHA256

        f8be60f43ddf1187e5659e843f6ba3fea5ce879cf29d3d8305c8b4f03342ee8d

        SHA512

        5f828878c937d9f0b184a53f09949eedef27b7585ca9e3b9b704ba4668b7dc7f7ded078876612c4f6ba40db013a3806747e558f143916087b7b4ed58f89b51aa

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

        Filesize

        1.3MB

        MD5

        b1cb404af0d88fcacc39e682f043e895

        SHA1

        8cd6fb422421727d901f7cbae701c15489101e22

        SHA256

        2f4eef81300c039433ccc86328bf317e76b84795a2526d7990bc4754d3bf6648

        SHA512

        b787fe821c87c28b1f7ae869031f0519a808b0b9a69ecee51d2da717bca8998fa92b70c7350960981ac02c67cce2d4eb0fb3680052e88cffe1fab31fed3651c5

      • C:\Windows\System32\FXSSVC.exe

        Filesize

        1.2MB

        MD5

        ab8de5120e1f854798d2e2312ab05983

        SHA1

        7da407651e5aab00eccc95712a8eafcb93e4738e

        SHA256

        4fd51080330c3de2b6d71ce79ae3a8c184cc2e22cb0b3ede9a9d2da53a15ca53

        SHA512

        17c6b1c10bba4425c068216d6dbbaea231cf07edf94f5054b5c6b89f36c53a1cbf932781a02efce0102b88945fcd4c325c4467ea6c9e3c5c6b49d896ba9d513a

      • C:\Windows\System32\Locator.exe

        Filesize

        1.2MB

        MD5

        b1b85443a9195eab3979b72a4ced793e

        SHA1

        fa794f0ebf68ed116e5c742188c491724a85e8b6

        SHA256

        c011cb84987697b2b2e27f1f68d9eb52041219845d42a70d3d6633d09d4c1ca1

        SHA512

        2149576145a9d2723d5b8c381ca8d43dfd2e45c5909f292042bf1f37490a5a5aceced3f3d65713dc3e6e6b3a3ca5d0234b146eca1f57d319a880db562e422d8d

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        1.6MB

        MD5

        af8fede68c1b65e4fbcef23dcf0546c9

        SHA1

        cee7ea4d840cbe9658c248f580b5acd2cd4add95

        SHA256

        25b880c774c51c6114f8ec82b3821c58a9e54d03d9628a47b66ab4c7f405bb09

        SHA512

        422693793be18cb8072d54468489688414ad8dd654f83cea29cbda1e2804fdb811ed93cc65a109e396aa2c33a8208092f04a88efd709a23e44b98cc5dace3e6c

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        1.6MB

        MD5

        af8fede68c1b65e4fbcef23dcf0546c9

        SHA1

        cee7ea4d840cbe9658c248f580b5acd2cd4add95

        SHA256

        25b880c774c51c6114f8ec82b3821c58a9e54d03d9628a47b66ab4c7f405bb09

        SHA512

        422693793be18cb8072d54468489688414ad8dd654f83cea29cbda1e2804fdb811ed93cc65a109e396aa2c33a8208092f04a88efd709a23e44b98cc5dace3e6c

      • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

        Filesize

        1.3MB

        MD5

        25bca1b453e1271c327f81c476fc1887

        SHA1

        57a3932a8b70c970eb751722713f8cc54c451e4f

        SHA256

        2f193ed0221d55b07c19febe9f05d993ddd13359c911a99f615cbe4eb8d0a459

        SHA512

        aab3407f28d123d994ff3aeb924955f26101c4fbd2ddc4a67bb62ba0ed7ee63591518026fc4b4aac9efc0e35b4ff0c0a31ce2e17da81a39ab304275bf851a6f6

      • C:\Windows\System32\SearchIndexer.exe

        Filesize

        1.4MB

        MD5

        4aaa6b56d6e6eb2bf98fba3429b16fbe

        SHA1

        6970346d659cf348fa1bb22d36e4ed26dca46484

        SHA256

        60714844ef6c9e4ce6d78fea7bd52e110f7fd33d4133856f150f879b42fdd73a

        SHA512

        10d68763ea2d6789471f09cde3ba687b195cddbfadccb572d136767a939d5aaa4ac651261b61244017c6f8bac0c9fe3f884459cd0bf8022d3a59fd9a9663a110

      • C:\Windows\System32\SensorDataService.exe

        Filesize

        1.8MB

        MD5

        097f17bf9ec9420322dffd1baaa7126d

        SHA1

        06020dbe0eb9a5e81f1e379829077d59d4b08e8c

        SHA256

        b6b4ca18e7d77ec3569fb53369e5396acf27449389f4c165df29f6f094cf11cd

        SHA512

        9409b81d8ab56ff75256e725405976f1c7a213cbc5bb8eb5d59c114615c5a35249abf13090fa45fcf5c55a0ab0f671dd7d2c67b36381ba2924b839de2ba2414c

      • C:\Windows\System32\SensorDataService.exe

        Filesize

        1.8MB

        MD5

        097f17bf9ec9420322dffd1baaa7126d

        SHA1

        06020dbe0eb9a5e81f1e379829077d59d4b08e8c

        SHA256

        b6b4ca18e7d77ec3569fb53369e5396acf27449389f4c165df29f6f094cf11cd

        SHA512

        9409b81d8ab56ff75256e725405976f1c7a213cbc5bb8eb5d59c114615c5a35249abf13090fa45fcf5c55a0ab0f671dd7d2c67b36381ba2924b839de2ba2414c

      • C:\Windows\System32\Spectrum.exe

        Filesize

        1.4MB

        MD5

        538a4bc1c7f3c432cf641886388192d6

        SHA1

        657fba5390605f9c197f9f978c095f1c0cecb5af

        SHA256

        19e3874a23b9cf1ec14f97502a37b6fb556de0f3bf3bb3de3bd3cd073e1841d6

        SHA512

        02dad5fa9d5b426c67eb6758e4fc53bf4da6e1a79f0705c487ad469200661da9342d30129ea6b5100481c8518404c0f2f7caa001b912ff6f6bc2c4af6ec7cbd5

      • C:\Windows\System32\TieringEngineService.exe

        Filesize

        1.5MB

        MD5

        a53c4276dfddf48e2b5788caf64acbcc

        SHA1

        6bca9cfbff0713cd2d10058803e4f5b2eeac7fcc

        SHA256

        48cca7122c49d7fca9ee45130250f6b41066a110e8cffb4c995a4cb2692b5c43

        SHA512

        137677ffd6c2ae3959a98740fd68f255d144fea7172565fd062e8961dcba7086aa0673303059aa12bf6e2f8f279b4cfa9e9c670006b4f24336cfb6a9390016c4

      • C:\Windows\System32\VSSVC.exe

        Filesize

        2.0MB

        MD5

        adfbebfa10d9e932aa306d473f751c2a

        SHA1

        6f2166dfeea741ae861484d656a41d62856ddeb2

        SHA256

        2837c8632310d5912dc7c649be2dac97f4ec37403c63bffbbcb855fdab08678e

        SHA512

        d5bab559a142e03587b55f03a114fb2714158599751679bfaa0fa56e811953de6f0948a522d318bbb1247dd36c273e9beb5e310898c1576dc8af11e515350e97

      • C:\Windows\System32\alg.exe

        Filesize

        1.3MB

        MD5

        e0f9f911f72950b17f9f7f14d89e0faf

        SHA1

        38307adaeb8fdd65706c0278975b622f7553dbce

        SHA256

        3b149ec5e23267214fafbfa6c348c57eeeee04ed7abe7533621b3d20ef63b3e0

        SHA512

        9c6c75d3bcf7908ece0259bb412da3b8e5ecfa0f62ef9dfe8b69c76f4a39a09b8b37536405fc57b3b3224fc332fd3451c2da4795c4c4476e4014c6e83b3d4b17

      • C:\Windows\System32\msdtc.exe

        Filesize

        1.4MB

        MD5

        6caf2f7e5820f5ddad627ec9bfebbdbd

        SHA1

        7b95e64b44202b865d47577846689c265fb53cdd

        SHA256

        f537d8453439f33e80c64dac477593596b1e81097c01d90d4c7292b2ecb0599e

        SHA512

        25eba7ce8adea3770379024c37c42ae5fa42d306bcf54b1c3c0bd4867f6212fc82a9199c0027312acb410b66240da52df4548cd7081c0e22ab84a1851df29386

      • C:\Windows\System32\snmptrap.exe

        Filesize

        1.2MB

        MD5

        06a374e328058c15a916c776c396e837

        SHA1

        91055acbc2f7976816c7aa76ee27921335c00cbc

        SHA256

        c3ce320527b1ac8e8db6e4b3a671a51772bf78e548313fe934d335dac204e4cb

        SHA512

        4961afb985f15e396610aacfb9ac47a35608b71876dbb39bdf0bef48f4e31d8e1326b2fb3f97b6d0fbcda43f51db7c49c283df0ec2780e7574e6aae94abd854f

      • C:\Windows\System32\vds.exe

        Filesize

        1.3MB

        MD5

        2221d8caefce7ae07502d6ce8c0a2407

        SHA1

        868a17971952fdcdecd50b9ca818b1a7c4abbcdb

        SHA256

        55bada3ec510f92247a7a1c75c57028680273d9d64f2e73c6a857c2dbf1bc224

        SHA512

        de06b3bdd60050ee692066eb5acb5c068e78e01a6cdd756b1756436de38b5b560e66d9855e26d6d03495adc88f16a2562c8d6eb8d2e5e6ca2b73a5319fced4cd

      • C:\Windows\System32\wbem\WmiApSrv.exe

        Filesize

        1.4MB

        MD5

        4417710f9c9516c874dd720906505fa7

        SHA1

        76886f497cf3b97bbec25652e4f5857616f9b581

        SHA256

        d962d942579ae3eaeab57ebb72fa9f6b696a4564fbba62a3723d182730061207

        SHA512

        fe5f419f9029f018036b080e397401b085f0dede53a596857a7d592417ea527acc43a9813a143a2afd43b1b9c08d66a6e6a6256defe7e7b20ddb729ecd14e3ae

      • C:\Windows\System32\wbengine.exe

        Filesize

        2.1MB

        MD5

        cb9a23f9c2c141d27fb790f292674019

        SHA1

        85f638ba074107696118c8b19f77ed2c53c3cd76

        SHA256

        cf29e678f0e17f7ecb0d2eaab214a629f293c20dbdfd366a0e41a30a793250b1

        SHA512

        2a8980cb877706b5140f42f79375b866e7c81ff9d56ba95c08aa767f86e1c4cdec7d6c579bcdbd90d11ab73c03b16efe67e111fbd1f5872ac8ce7cc787a2a9c3

      • C:\Windows\system32\AgentService.exe

        Filesize

        1.7MB

        MD5

        6394db6f0fa52175225a417cba787c35

        SHA1

        7ad6d3f6e4612c158eabbc6bcf78ce5093695956

        SHA256

        f8be60f43ddf1187e5659e843f6ba3fea5ce879cf29d3d8305c8b4f03342ee8d

        SHA512

        5f828878c937d9f0b184a53f09949eedef27b7585ca9e3b9b704ba4668b7dc7f7ded078876612c4f6ba40db013a3806747e558f143916087b7b4ed58f89b51aa

      • C:\Windows\system32\AppVClient.exe

        Filesize

        1.3MB

        MD5

        d24e76c25b38a2b26bf52e37d2daef3b

        SHA1

        e0a4f180a7ec53437cf9e934abc02ccdb65b32fb

        SHA256

        37a58201150b891979470870b6932444f70560c4f382ba7eee919f5f11148ddc

        SHA512

        017d18409cbbdda4827b186b3cde5af36bbe26e0a940f7c12a0aa6ea024958b28e2ac3499b16676c0e6dcb92d00222fb23f104f8c851bd8193183c08f8db30be

      • C:\Windows\system32\SgrmBroker.exe

        Filesize

        1.5MB

        MD5

        6271dbcec977b873d4c527f0d66b7508

        SHA1

        b1a36e9f77f1677deae8dd630db6ce9e9edad4ac

        SHA256

        32bdac7bdc587fac754a6ab266af77eb5935079cb4286387d47b49b6667d623e

        SHA512

        f325a512c8456c8a7041d964644075f12365df139aa7f316dfb46bdc3e952165202e97dd37ff4e9df4aae81f547eeee6123cacf106d201c22e0d627d80544a94

      • C:\Windows\system32\fxssvc.exe

        Filesize

        1.2MB

        MD5

        ab8de5120e1f854798d2e2312ab05983

        SHA1

        7da407651e5aab00eccc95712a8eafcb93e4738e

        SHA256

        4fd51080330c3de2b6d71ce79ae3a8c184cc2e22cb0b3ede9a9d2da53a15ca53

        SHA512

        17c6b1c10bba4425c068216d6dbbaea231cf07edf94f5054b5c6b89f36c53a1cbf932781a02efce0102b88945fcd4c325c4467ea6c9e3c5c6b49d896ba9d513a

      • C:\Windows\system32\msiexec.exe

        Filesize

        1.3MB

        MD5

        5896c49138952667aa049a579b0e6956

        SHA1

        d0c84295ddc8ce8aee12c3bef2c9554dba9f1071

        SHA256

        64791e116ea3b214570061d34f7c71a012ab75fcee78e6599c18daa2d56e58ff

        SHA512

        d0c040ba8847f9db26b7a3a1a6ebcc6666747e84668d48ed778ca23c87c83ef32fa1b1dd45305e7ebd2b230216e9b9e29cbef55a1fb10d2cb8174c21d0c89d5f

      • C:\odt\office2016setup.exe

        Filesize

        5.6MB

        MD5

        13e691f68c405585698025f70a1f09c7

        SHA1

        54a583389637eaec8a0e73aefbaa7be36918c4b3

        SHA256

        02be690cbf5b0435b211118493b17f296622d7055cb8eece9dae224f646282ad

        SHA512

        6bab34ee57c1ac3fd6378768f0279e389b3bb20803cdac0da05e08d3003cbcf1e4cb789333796a9774dbbf4c86d9b041e51f7590625c4d808eb79a5cba873752

      • memory/656-163-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/656-143-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/656-140-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/656-144-0x0000000002CB0000-0x0000000002D16000-memory.dmp

        Filesize

        408KB

      • memory/656-452-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/656-149-0x0000000002CB0000-0x0000000002D16000-memory.dmp

        Filesize

        408KB

      • memory/696-337-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/1064-552-0x0000000140000000-0x0000000140210000-memory.dmp

        Filesize

        2.1MB

      • memory/1064-234-0x0000000140000000-0x0000000140210000-memory.dmp

        Filesize

        2.1MB

      • memory/1064-235-0x0000000000D00000-0x0000000000D60000-memory.dmp

        Filesize

        384KB

      • memory/1176-394-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/1436-133-0x0000000000290000-0x00000000003F6000-memory.dmp

        Filesize

        1.4MB

      • memory/1436-139-0x0000000006ED0000-0x0000000006F6C000-memory.dmp

        Filesize

        624KB

      • memory/1436-137-0x0000000004D90000-0x0000000004D9A000-memory.dmp

        Filesize

        40KB

      • memory/1436-138-0x0000000005090000-0x00000000050A0000-memory.dmp

        Filesize

        64KB

      • memory/1436-136-0x0000000005090000-0x00000000050A0000-memory.dmp

        Filesize

        64KB

      • memory/1436-134-0x00000000053B0000-0x0000000005954000-memory.dmp

        Filesize

        5.6MB

      • memory/1436-135-0x0000000004E00000-0x0000000004E92000-memory.dmp

        Filesize

        584KB

      • memory/1468-398-0x0000000140000000-0x000000014021D000-memory.dmp

        Filesize

        2.1MB

      • memory/1468-646-0x0000000140000000-0x000000014021D000-memory.dmp

        Filesize

        2.1MB

      • memory/1840-215-0x0000000140000000-0x0000000140237000-memory.dmp

        Filesize

        2.2MB

      • memory/1840-201-0x0000000000400000-0x0000000000460000-memory.dmp

        Filesize

        384KB

      • memory/1840-194-0x0000000000400000-0x0000000000460000-memory.dmp

        Filesize

        384KB

      • memory/1840-528-0x0000000140000000-0x0000000140237000-memory.dmp

        Filesize

        2.2MB

      • memory/2008-165-0x0000000140000000-0x0000000140201000-memory.dmp

        Filesize

        2.0MB

      • memory/2008-453-0x0000000140000000-0x0000000140201000-memory.dmp

        Filesize

        2.0MB

      • memory/2008-162-0x00000000004A0000-0x0000000000500000-memory.dmp

        Filesize

        384KB

      • memory/2008-156-0x00000000004A0000-0x0000000000500000-memory.dmp

        Filesize

        384KB

      • memory/2220-598-0x0000000140000000-0x00000001401ED000-memory.dmp

        Filesize

        1.9MB

      • memory/2220-307-0x0000000140000000-0x00000001401ED000-memory.dmp

        Filesize

        1.9MB

      • memory/2236-724-0x000002D2E8220000-0x000002D2E8269000-memory.dmp

        Filesize

        292KB

      • memory/2236-797-0x000002D2E6980000-0x000002D2E6990000-memory.dmp

        Filesize

        64KB

      • memory/2236-672-0x000002D2E8220000-0x000002D2E8230000-memory.dmp

        Filesize

        64KB

      • memory/2236-640-0x000002D2E6980000-0x000002D2E6981000-memory.dmp

        Filesize

        4KB

      • memory/2236-612-0x000002D2E6980000-0x000002D2E6990000-memory.dmp

        Filesize

        64KB

      • memory/2236-611-0x000002D2E6960000-0x000002D2E6970000-memory.dmp

        Filesize

        64KB

      • memory/2244-176-0x0000000000690000-0x00000000006F0000-memory.dmp

        Filesize

        384KB

      • memory/2244-186-0x0000000140000000-0x0000000140200000-memory.dmp

        Filesize

        2.0MB

      • memory/2244-170-0x0000000000690000-0x00000000006F0000-memory.dmp

        Filesize

        384KB

      • memory/2684-359-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/2708-268-0x0000000140000000-0x0000000140226000-memory.dmp

        Filesize

        2.1MB

      • memory/2780-370-0x0000000140000000-0x0000000140239000-memory.dmp

        Filesize

        2.2MB

      • memory/2812-232-0x0000000140000000-0x0000000140221000-memory.dmp

        Filesize

        2.1MB

      • memory/2812-220-0x0000000001AA0000-0x0000000001B00000-memory.dmp

        Filesize

        384KB

      • memory/2812-226-0x0000000001AA0000-0x0000000001B00000-memory.dmp

        Filesize

        384KB

      • memory/2812-229-0x0000000001AA0000-0x0000000001B00000-memory.dmp

        Filesize

        384KB

      • memory/2856-566-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/2856-305-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/3556-180-0x00000000004F0000-0x0000000000550000-memory.dmp

        Filesize

        384KB

      • memory/3556-188-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/3556-187-0x00000000004F0000-0x0000000000550000-memory.dmp

        Filesize

        384KB

      • memory/3556-191-0x00000000004F0000-0x0000000000550000-memory.dmp

        Filesize

        384KB

      • memory/3556-195-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/3700-372-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/3700-639-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/3920-270-0x0000000140000000-0x0000000140202000-memory.dmp

        Filesize

        2.0MB

      • memory/3988-671-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/3988-454-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/4204-396-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/4300-338-0x0000000140000000-0x0000000140259000-memory.dmp

        Filesize

        2.3MB

      • memory/4652-202-0x0000000000D70000-0x0000000000DD6000-memory.dmp

        Filesize

        408KB

      • memory/4652-214-0x0000000001A00000-0x0000000001A10000-memory.dmp

        Filesize

        64KB

      • memory/4888-300-0x0000000000400000-0x00000000005EE000-memory.dmp

        Filesize

        1.9MB

      • memory/4948-212-0x0000000000190000-0x00000000001F0000-memory.dmp

        Filesize

        384KB

      • memory/4948-206-0x0000000000190000-0x00000000001F0000-memory.dmp

        Filesize

        384KB

      • memory/4948-218-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/4948-525-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/5108-303-0x0000000140000000-0x00000001401EC000-memory.dmp

        Filesize

        1.9MB