Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 09:23

General

  • Target

    2024-06-03_007ad9660d0e32d6e7a0bd9310224c21_bkransomware.exe

  • Size

    1.8MB

  • MD5

    007ad9660d0e32d6e7a0bd9310224c21

  • SHA1

    048f83d43ce1729089e4d11dfdc1b0f04480b737

  • SHA256

    aafc4c4f724a5c8d274118ee70494ff687e4d5194b6067aeb476bde9e50d621a

  • SHA512

    30f248bcaabf92686aa90c57feab9d4c4d080e0c3f82dafd5f307c8abaea273987dbee3a18f24605ebb38e3af98349aef8ace79602eb2a78adc58865e6674f74

  • SSDEEP

    49152:uE19+ApwXk1QE1RzsEQPaxHNZ5UbU62FAQ228QKl:T93wXmoKrqj2FAQL

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_007ad9660d0e32d6e7a0bd9310224c21_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_007ad9660d0e32d6e7a0bd9310224c21_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1692
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1224
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4520
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2308
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4724
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3952
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2496
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3924
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4660
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3800
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4056
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:436
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:456
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1196
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2824
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2304
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3380
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:1212
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3220
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:968
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4908
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3736
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4616
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2988
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3788

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

        Filesize

        2.1MB

        MD5

        d7d0639d6d465d26a50da20cff9f4c07

        SHA1

        e9914fa778814e69cc76e1800d82a12ed35adab3

        SHA256

        bb9aed74bed846688ea837e1684257a0ee0af86fbfc05abaf4b17fba240d5045

        SHA512

        6b57300a341bc81957b9dfd8d9d1ca792e3431ccd79039c87324609019dba11ac74b4a767c1ba40df7c78b8493bb4d14c33e46a4da91d79fc6285ecdf14cafb0

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        1.4MB

        MD5

        5ea9d67a0ba111e7aae3767d7d05b678

        SHA1

        7b7a1d81fb33a21424480fb107bdbfb38696545e

        SHA256

        6e7e09f4b33d218d7d3336bb96639cd2dc416a8abb1f3ad097a47190a6f80cdc

        SHA512

        432e13b5a506ab46cc47a884113016358b0b85449ebfd4983da4d8991f0341b6c8dbc419642d33f71d633def3eebaffffb4b3106e7c7bef418e56ef4c4c237e1

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        1.7MB

        MD5

        9e206ceea0b7ace4460f4f5f9f5ff8ea

        SHA1

        9c3783e6c861357899ebf7db0e2b95099aaf85dc

        SHA256

        391d28ca0b50e897ab42402cfc7a3ff8235125b357072071563b6786fb461232

        SHA512

        4a5fd20a62da6699b4f098b0e938dbcb4579d9d6d726dd40355b90c5e83127725b9212e4618d67c293a6d03f0ae390021efbe4e6538621efb79e60ce959c7041

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        1.5MB

        MD5

        6f791c6c67c66bcac01774bc02a2d2ae

        SHA1

        4af03030d0471623274e09f895580f68867a21c6

        SHA256

        dfb01738b6157906f9c5fae9fd13db29db6120e7af8672799a4aa1df1c51de84

        SHA512

        230faccbd1d26770c9c898c4d4ee11491f5b2337cf8a053175b71ef4bc8295aa8954c933390ad687f12e7975dfa4367b4c9e81fe02dbc0703487b61ab0ab40f6

      • C:\Program Files\7-Zip\7zG.exe

        Filesize

        1.2MB

        MD5

        4f2195dbdac04f96cece227cd6b4be9d

        SHA1

        997580fb617f9b96b8fe9fdab782bd4c0320af6c

        SHA256

        f576975847e8aabfcb52f81eff27815f39a571255a9b7a8d52f697cd1dabda65

        SHA512

        80c199b12685473c8eae9e4bae2681e0b9e756e906f090f8e960984c248e08c1e46d7bbeccb1337181e8a5b7b3144742b4c01a6e86ddea052917d7442711160a

      • C:\Program Files\7-Zip\Uninstall.exe

        Filesize

        1.2MB

        MD5

        6c582cb0b3334d5e23efa825a5d519c5

        SHA1

        ed39e66f6e4b72cf685f4b1911c0becd824ac474

        SHA256

        91986c101121d38408f3af7db82700993451bc7bbcc6441ee6163dd4da8b68fa

        SHA512

        ebd4117843c5c9044a21a63de1e31adacd28eccc1ba64f3d0937ed1b07c750bc7a544eb8be9d0169b709666239cef283a2968c990120d22ce5956413e3607f06

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

        Filesize

        1.4MB

        MD5

        0701710735cd117e693c683ff7d21e7d

        SHA1

        fe73635898c2eccb76c14acf7b865c8e9802b8b6

        SHA256

        45ef34f7385d3a70a77fc2ab2882dbc68e252e3cf982c4d390c3ed7f0b231f85

        SHA512

        600706a733469c6d3a10e6ff242190ca408ff1013aeb6ba817b1fce474b45068777009409bc411c825360cec1459ff4c8d90a16d6af896a8ff335c40b205b927

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

        Filesize

        4.6MB

        MD5

        6819d6e0d4177718372cb4654fc98ee1

        SHA1

        12b50372ca36c3db0bf066b6ff9d4592a1b17cd6

        SHA256

        8b740bfcbc5964c521aa2c3fe2dee3fb467d815753c5df033f0616070b5323d4

        SHA512

        8e0cb5d864d09bf85d462b078529742bafabadc7836318600f2dad7f5438daa9fa5270a33218165eaffd141b681c52ada86f2d533dec7566024cd9b7b091932c

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

        Filesize

        1.5MB

        MD5

        98432bb75fc19f6a9453a16b092c0322

        SHA1

        82f8554a1f2f98611206400c71998b9bfe1657be

        SHA256

        ba36fda6e0e459218348f05c719712b9c5a1f5ff6fe0439f40f7cab52433137c

        SHA512

        270a49c597e5115ea533e0254653112d6413edb1c28ae29c15a23cbc1a736e652d4be67a03b536d7bcde5eb58448f60dcf77acc629439de1b3458f16130d3dfb

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

        Filesize

        24.0MB

        MD5

        eaf5eea83a183bcee5a281de998e440a

        SHA1

        262380519d1a7822b5c11502928ebdb8cc544ffc

        SHA256

        9fa11fb310663add01ab1ef02bacec6d07b17ce153bd3bbc3fa2fc3266fe47c4

        SHA512

        36734fcb60bba06ad262ea0919c849a0570dcdef0bd16be8740c9498fbd69ffe2e34ba54dbec9df30f9d011dbbd40d65d06df7630de78a96587cc0aad7b2dfa3

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

        Filesize

        2.7MB

        MD5

        3a2311c4fd4945b3e2dd756d4491d12d

        SHA1

        b6c8e0eac718fde126a54a44fdb3daf0782c2647

        SHA256

        13a6eecdfccfc8c09d2a848816be785b4b6d53a8a455b6991daa1dcfc3d8c3bd

        SHA512

        7e70ef4b0506935dbd0f631cc763656ad20fdc6be7f08e8e83df228c91dfe010e9efc4dbc2c0cf5eeaa493e2f2911b535428afdbb502035d735e559a146bcd3a

      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

        Filesize

        1.1MB

        MD5

        9b85d80fb9eee2a0b34f33eac01a4127

        SHA1

        cf70990b1dbb2b8969b9dfee3f24d1d285ca68a5

        SHA256

        8c51b1fece81dfff029d2056ca801d10d725decf5988646df59e3d4291e1f173

        SHA512

        c3d2901c197c878ae3a5456c5df57f3356ef2d8f73b58d04060b742c560a13e88aea8326b297f884594fa41f2b67ad7ecb17fd0fa57daabf49249a53bccea97c

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

        Filesize

        1.4MB

        MD5

        ec0b5944fc60e74f1547ef9b1bcae915

        SHA1

        cd97403bccd2da68e9d25fb3582e8202338ae566

        SHA256

        543860dd6328a34cb7e36e59de2ddb68b85803350b635cd027f42e84f4918d17

        SHA512

        ebb81b6c3367e74fbdf7951069219d99feffb740eb3d8119550d19e000c6346c3b64d8edf94fc78f104ae7eef2b5e9a126fd626c252fa2eccb6b55c4a9b38445

      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

        Filesize

        1.3MB

        MD5

        8382aab2379e6a2bda08291bcf95e099

        SHA1

        fadb99fedb1d04d517db6229d164c6dba0620fbc

        SHA256

        959f34f3bee2562cc4e83845514ad0e7c41f5deada1c7e05095b6a34f884e761

        SHA512

        5b4e21a074e8d5dd39d8673237be537622bab9182a424851b33f74b2b9d521c399de3a41fb7137bf09160722767bafc49beeb15184725ad842f79e36d7642142

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

        Filesize

        5.4MB

        MD5

        890c11191d6ba9f1b83ff49af708fb0f

        SHA1

        856a43c772141ccfb2775e6fa1d7b4c7d0d7864d

        SHA256

        14ff358aaea6cc5b0b5ccd2257c2a8d6a37487cea370a53f1db29bf44ecebf66

        SHA512

        c481d6f2540b5564b6fc0e8e981f1e0aaff390b22344cdb218a060215e686e5d16e96c5743f810515775ff255fc30825ae67e1326df1f7cd19a33252d9ea28a3

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

        Filesize

        5.4MB

        MD5

        8628032c6942c00573a121afa1b2c6d3

        SHA1

        3fc739a7f6190fd6ff296ca1b383f25eba3a2c26

        SHA256

        cf4dfd56d7bc2ce020199a58014ec4a822830192ce2c87dc830d5a3fd093812e

        SHA512

        6aa9b7f0ec2ae6feda45a784e29d58f341b4dae6399aa89c19397d1898564aa0d7b0238fd4576dcec2672f0a6d49a0d7e5597fd27d357f7467dd71fc31cf0df3

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

        Filesize

        2.0MB

        MD5

        b7fc9644e387696e5f50d97943d4651f

        SHA1

        89f059bba6445c6f03d18d7f58dbc874af78a486

        SHA256

        8ce876ff272b067405b9916a7702892c7d7fcbbd214a51c1937161d3baebc4bf

        SHA512

        6ac1f4b2c91d58c6b1c9da2cbe19be5b564e664578294908b18444935c3e262745707631dafaccebcc6e48dca6569d5967cf5afa14a643657ce4523d484454b1

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

        Filesize

        2.2MB

        MD5

        3486ebaa2183073dad35bf44d24a0e03

        SHA1

        f4459bd38150e712daedfd27028545550099748b

        SHA256

        fb47cb75a732a3f4a34d40eca54947469ade2da05bfaf811117575277e256373

        SHA512

        22e280f0c246f95bcb59cd794fb3851c265c0749728b5fcfda5ef381432a67113f6cc093bf5b5dc8a4e56b8ec8a67359ed9e18eed66914b0b47f2db8a81893a1

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

        Filesize

        1.8MB

        MD5

        5ed0c3c12bad8efffe5d385426d86f00

        SHA1

        853b6629b6923fc76dacf7f4da5ea610fc3d0ccf

        SHA256

        8acf80863163e0dc931572653e538407b85db2d6abbc2a4688670f4377929c32

        SHA512

        4872d11563f731dd68fa2bde6eed6733775aa5df289260284f78da5be98d7f6ec37aba0d383095107ce777b52d9b1f8cd311425bde5f98cf77719692e0c0bb9b

      • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

        Filesize

        1.7MB

        MD5

        276e39266859ca95082910ae5f65bf47

        SHA1

        40b7cd5fc3d3ee6f92dea660c2710198f414ea52

        SHA256

        dc5988d0cff5c1714ecf6eb536ec5a9154a6b03169f7fb13b21334cd1234d51e

        SHA512

        433e8e59ec9f0ad3336471b299fcfcd0c4be0a3de69f4052f66024d9e598e26003c632767ae5b85b35a88b776bd2713372bbaf3d2b9f557c054908673c5b367e

      • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

        Filesize

        1.2MB

        MD5

        0addc0569722091001709f86c6f6b499

        SHA1

        fba0d8fafb8571c735916c81b303e4496a385934

        SHA256

        a2c697d672c9577a7e35d3d7e1db1ec08d91fd1b73c6bab4610da47d80f661c4

        SHA512

        e52f9fb6e335471c7334f72d672dbfc3525caf35e4dd49ca848fe7a2a75b5658d98d2c6078d10574034706270365585ade584e662f96f85cf22d69f443842fb4

      • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

        Filesize

        1.2MB

        MD5

        edfab73553fec85df7c5ff0ed162c8a6

        SHA1

        469dce2c28f7e981a689d2a9ccb67606be929bd7

        SHA256

        12468a4c1b5ef8dfa2201792a1a45716092f6435815259399949dc4b66a1404a

        SHA512

        6ca44c029bea074326ec1f9beb165c8530d9fd30fd518c5538540fb5ea93bc3ad14efc249c876768c7f8ca5437c531c67bf0cc43be476d2b67f5da7e76dfde9f

      • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

        Filesize

        1.2MB

        MD5

        8c5d5deb53999776af1e74d1a14a7451

        SHA1

        e0531d4748328ead1bb71fd66560eb03188701e7

        SHA256

        b7501d48c65ac6dd305eb8dd3f12e121138c0efbac0234c41530f4ab59d25ad6

        SHA512

        b3367e2f75e4ec980f33923ae6bb1a8cc889e23c800b1d81c5c86aa2de2c65d436ed2a70891cdae7e6d77b7d3d1e4480430eea76acac37b6bb6931a8f71e4ac2

      • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

        Filesize

        1.2MB

        MD5

        6145ac458b94372d03637a9cc6b16467

        SHA1

        4d91093bbc0d6dbc3b63051e8631ab30ebc35dbb

        SHA256

        cf2378116efe30e91a63bdec05ef241b53342f8b1f63c3de1e72e3db9095eb44

        SHA512

        ad273db4fbd5893ac5395171ff4f38e8eb5b89f929fed95bc8733100f3d432852c6c451ac9709af20f0f8d56471fa76f17c5a48b17c3e5fd9dd6f29b257bd8a7

      • C:\Program Files\Java\jdk-1.8\bin\jar.exe

        Filesize

        1.2MB

        MD5

        5c72801bcd749481a83a00cb29af427b

        SHA1

        914b5cd965b708d0edbe60be6469afba4c71bfe2

        SHA256

        500754554e9947fbcf6ec4ebbdf468e2fe51c462606e79c970f8a1a56b02d7cb

        SHA512

        53521ea6a8dc6183a499e36d15b3bd4f79abd487d5e2f98cfba47f6cb6b676a21f2f63f0a252f245c7c8fbd16c24ea8005e2f52c15d4c21a46930594c544d20a

      • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

        Filesize

        1.2MB

        MD5

        bdc8b32eee044f0816ca16ccda261aa7

        SHA1

        8a303836ead3d25140748ba501080e262c32dc4b

        SHA256

        1e2b7493383e35f0cd830ba2af35187793deb90ebe649c5003047539038776d3

        SHA512

        a1c2cebd8a658b8462a1fd010628467cd4b96ffdc10fc8fbfa1f4658b80832bdbc7b8b59af46c339974e8e8d029466cfc93752d05273b581ebaf66fd782fb6f2

      • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

        Filesize

        1.2MB

        MD5

        3d1271a7f5658a1c1584f4d5ec53a32b

        SHA1

        5f769d5aefa7471b0be4913e61c36513ed6f8abb

        SHA256

        499b5db88dc0b7f9ffd2c82a21dea924488c1b7ad081c9457a930457ed1973df

        SHA512

        ad5ec2c3de42f8a162fa96c6c4ad48edec0f6471ee794d65b5750802978ce64304c0a989beb80ad847aaa28cd9327e3898222453152d28d84afd4f7018063f58

      • C:\Program Files\Java\jdk-1.8\bin\java.exe

        Filesize

        1.5MB

        MD5

        eb2ecb9b1895bbe62d5b023bfa829211

        SHA1

        80c3f7046388e4d58400ecd27f3ea980df57b9f1

        SHA256

        89cf984a05280bec164219255c6d2d4c6275d22e13c36b0774154b4be4e537f7

        SHA512

        6c6bcf755b35990170a9f04dbd610e4dbcaeb077c24143e35e16bd461f5e562ffdf4f7366c7bc26e8b4a881bd51717e6f6ea0b9dfb9e1da659e91b1a5e5a89b9

      • C:\Program Files\Java\jdk-1.8\bin\javac.exe

        Filesize

        1.2MB

        MD5

        cae4f718f7f38e23c6137b0eeaef0fc7

        SHA1

        b24a2d22d4876c8de04b360d2bbd1ca295b75cd0

        SHA256

        c7c7101707a28ad6ab4aff286d39310c337a0ba80bdd7d61743ca8fdd38b40ae

        SHA512

        2852478f8433f364ed99fc98dca5a7fedfc9eb22575acfd982959698efc5b129f86083ade2ecfb1c613b2879f2917e5d4f4af9001f7ff340ee535031233a02e2

      • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

        Filesize

        1.2MB

        MD5

        e3831802643fef840d0fca7f25c06745

        SHA1

        914df57ec42035cfefad5a39843e1d4986d44538

        SHA256

        aa59a8d5f1681d91ed2e3c9ed0b549ab00218e9a74e6006e6f864f3b216e1232

        SHA512

        20cd3e0f030ce1e12082e0251750a825b23a5023712e9e51ff416fb07dfd2e72831691df70e5a34102fbe6fde2580fb75253fa06bad942c01776230ea3ac45a5

      • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

        Filesize

        1.3MB

        MD5

        655bf5a50d9b014e513dd08591376ce2

        SHA1

        9243f99eabaa45d82a0608b925e1e038506e765a

        SHA256

        f13e95de368276b78aa575915b2de3326f06dc3f7dad8aa3cb02712c348552f3

        SHA512

        b2c0fb19682bff11d8abaa25dd3fd8ece02fbb0c81d62227cd9ad50906f8a89bb178da87a86a653aa9b875ed73ebbc4a6650aeb6eef69545e12e01e78d13ab6f

      • C:\Program Files\Java\jdk-1.8\bin\javah.exe

        Filesize

        1.2MB

        MD5

        408d80d47e7353de8328954c379749a2

        SHA1

        3e2078eb8d442131529364e3746bb8978118c0aa

        SHA256

        edad381f4112f4465afa9f5a7ded4712a35fc486e37e8c9a3275dfb21e80ab37

        SHA512

        99ebaf3efe6b899dd72e5acb36c11d7788f7b6a17a6629cbfe29a89cffccf89d91bf3d5884a0bdd66715582d320f76f8ac312a78edc66401ddcad0fbd8511cd1

      • C:\Program Files\Java\jdk-1.8\bin\javap.exe

        Filesize

        1.2MB

        MD5

        9cc699dd15341b5cc50c6acf54c88bf5

        SHA1

        be1a2e2573e0e33de3360756d3c54371ccc4e0dd

        SHA256

        3f4c06b6ff4aaca6c2b04184a1cd1186c9b3698b5a05a93256934c3a50a58c01

        SHA512

        2298777cb8970f8ee93d78a7948a57b082f2a8a7774b891e1fbc477f5b0d20fd610159f38bfeecbd73ef5f440857f5cec5d2eea034a9215e725fe60e1c0e659c

      • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

        Filesize

        1.3MB

        MD5

        dfe01277f6f5e4d9e2e465e7c92bf39b

        SHA1

        21df1c385f7aca470bdae3ac8eb0e40bc7244b23

        SHA256

        78bb3cd591bcd6dda96227291d7d5bc6c1902f8026a130ef10e0fa4293300559

        SHA512

        4c651b9f70bbbdc9d91eeef08371f5df67292f350baeb9106a09fbc37bdebffd8e5181a7657dc5c7810f551b3e973512f01d3c91969a81a221d86fec61088540

      • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

        Filesize

        1.5MB

        MD5

        34a3695c2f134159c3914177fd1253dc

        SHA1

        137976c35d39394df9bc881c16d051cbed3693d6

        SHA256

        8d76a750781169aa1448927cf7dfa492222d26395b31dc25de7eb05114f39d26

        SHA512

        0af60ccfda30da1a2d92cfe5fce7d1405db7b08f6dcc3c27f2ad274404624f8bcc8ec516cad5c58ff5658330674b0743fcda6cb3ebd50009fd724c7994a835c7

      • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

        Filesize

        1.6MB

        MD5

        b6e6c82ab4f8270167a7410f5a89d731

        SHA1

        b2fc73b9846aa95b7e323398e38d80c39d567dbd

        SHA256

        75c63ef64faac8d1b630591ef2abf67bef73169716c84f77c28771c22e47351e

        SHA512

        90466f44a3a553ac015365e8b77621b7ab022ac0d7032ac037d4ab222eb7aded6006bd06dbf5cd7ea7fdc8832f0ac693edbc3b337062b3548b7cdc9c2a2bf6b5

      • C:\Program Files\Windows Media Player\wmpnetwk.exe

        Filesize

        1.5MB

        MD5

        13c7c5ce32bf8b5853489abe73f1f879

        SHA1

        4c6a13d9a9ac579f555d7404340cb09fb723d239

        SHA256

        982d8f8c029ab7498a2ee9ef3d55618efa6996844f0ddf7851762793d1752ab8

        SHA512

        0da4b67adb88cedeb722a3213a48c18132a913fa07a833312dd0c45aac36c634eac42f107609dc2830795df81c3e6e8b6256615d9fed54eeee97bceb4ffb0b84

      • C:\Program Files\dotnet\dotnet.exe

        Filesize

        1.3MB

        MD5

        ea1a0189586b2f2fba9f43cb58fbee1d

        SHA1

        1669afe452f86ac524482cd2ec51af965238cbe8

        SHA256

        3ebcd2f6474f281690212f008e57870d89d5e367b09e6281ef67638ddd46b21e

        SHA512

        3dd8c33995e6431f52ebb71dca3ce0bdb717d910e940e23181e334c3f798eca534576616674bde34329a80bce6c1ffa842fb976d072fe23f1327d8826ef3274e

      • C:\Windows\SysWOW64\perfhost.exe

        Filesize

        1.2MB

        MD5

        7907175f7ed8490361423db5a4b17d0c

        SHA1

        4768ae8186b84ab7eeb5b3907c6e06d6e35e68d5

        SHA256

        7a2bdb325c73eb24c1c07df025b8a89cf8a21aa045af8b208cfcaeb0dc23ed0d

        SHA512

        71c2071746b91b7d4d404132c675b4a9c99553a3c681558b7b8109cef9dfb7dd2a25c3d16c78b0fec2979428a937f3d913bf29ff4e1c2ebbac70dbaabd94a52f

      • C:\Windows\System32\AgentService.exe

        Filesize

        1.7MB

        MD5

        7354f0483f4c1cc38ad6e7904ba165c2

        SHA1

        74c7e96dc20a4e6d66cef48d7619bc7f77704783

        SHA256

        b8860a7192007ca04edcf2c9fafcea416c83a407fd5b8e16e67b39d1d0f92a5f

        SHA512

        777dbeeee9fe6288eb22b6743258392d56bf85169a676497d78e918b540deee02af9220eead316bccc33bc01519d165679aa1316e9207b28d07a802e39e7be82

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

        Filesize

        1.3MB

        MD5

        18e39ac229115315fe59c0cf3b5946a4

        SHA1

        f5ee1a858ac09f1595c913f7bee8e44f81cfd5e8

        SHA256

        81afe149b7492ff18a290a01f377b622a174a9721e9e9f2373ddb533173754bb

        SHA512

        b3d6ce0aab13d7dcb905b365ac77fe77f973a05ee24febcc887e88906942832bca204ccc373c21deb47f8ba4344befff97949ee5556dba59d41e53500bfd3b04

      • C:\Windows\System32\FXSSVC.exe

        Filesize

        1.2MB

        MD5

        f899586d0f061b4d966812dd573cc52a

        SHA1

        46ecad0bda028c832b585bf61388e42c29d7b076

        SHA256

        6061645a6d470660d184a2664882eb7ea5acefbc136db1f178d80eb2ac2c16b7

        SHA512

        32ae148bf32fd3fdf691986fe76671b61b8025631c199cbe1a8875f3006ceee64eeb5a03e47c91f8743cc471ba73fa6096e2b82281cc03b222ab38bafd49fb91

      • C:\Windows\System32\Locator.exe

        Filesize

        1.2MB

        MD5

        a338a4eafb8a13ea6505415088678c19

        SHA1

        209dba53da52164e2021410e0aba20402d3183ec

        SHA256

        33d536c50c5cbc0a4724231a9a7f8c8fc80bf467ec53193668016b6112461714

        SHA512

        28a232ebf041e0f880405c112a4e27febb67707a75fb8a5236e6444a9903aff2aaf73c5ede7eb3fdfe5ecc2f2713ae52aa3b57a76c83170efdacc4e3270d3992

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        1.5MB

        MD5

        3d48a2d9d4ad65c74f68e0284b193863

        SHA1

        9190b527ce11e697ccf71e6ee327325a4a0b71d7

        SHA256

        9448f484e9f5991b21df557e6499cbd06d25524f4c2d5daf57fb5893cef654fd

        SHA512

        d002b570a9c717fd76185d6ec174b5437af4bd9c290437a338c1c2ec141435e2ebc7e0b40f85bde092e1a259849c8dba084be782c4d7b07ecba7648b0056eeb0

      • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

        Filesize

        1.3MB

        MD5

        60e6719f622c8931b01d0e08b7f99710

        SHA1

        465b4abd8d9d4fa9ac75760eed954208409344c7

        SHA256

        f1a17eae1b22aa63b427f072fef003da7eab985ce5b82033246cd934b76a9c9f

        SHA512

        8d15af5901ce781459ffe08e32588ffe5a92af582aff867734737d3780d575f0f6ff2947c7bd893bfd965aff5d051a655bcc7a338790c6eb0cfa46bcecd994d1

      • C:\Windows\System32\SearchIndexer.exe

        Filesize

        1.4MB

        MD5

        c90d5ba7b6282a25abf2d945d893b4db

        SHA1

        83185b190025b520de6bb1677bf29bb657f3cbfc

        SHA256

        aa0f9ab56e81eb64485951c400a630cf1195dbb4015d70d89306cfc19e822efd

        SHA512

        f0da167e430b7bce9a41dd738ea49d1c75864dc114957a8ac12428234532cebef470c49613ddc0e1d327c9c5bcfbdf4a85d19a01e649ef3abf24f5e4f3b79115

      • C:\Windows\System32\SensorDataService.exe

        Filesize

        1.8MB

        MD5

        0c57d75cc1e63c8e6a15197aa26f3824

        SHA1

        c860825b0369cb74d9acd4acdf2ac7ace09dd420

        SHA256

        5a50e553889630d767f15d7b4a7a03f194148148490b029f70e165920efa0da6

        SHA512

        9115fd1a494fd74a17506938e21643a7f012e098546e4b3a0ddb7e81b12522ae32ad1dd071ee71728b7a082946cdc5a98c75e1639b56a87e1d5948a54b9a6eae

      • C:\Windows\System32\Spectrum.exe

        Filesize

        1.4MB

        MD5

        8dba428f9a775b4d1a04ff4c5aab9fe0

        SHA1

        0e12f2d9b58b2408932e36f8ccc0e1bb4950584a

        SHA256

        93960a32a8c5691e4313ca04bf4e5da22e1be680f2d9d9454c9975b1c12b15fe

        SHA512

        c0cbaacd54c4ab36576f00594f15ef16c71cf5497000cae43a149153e2f461c780e1f0486bf54d03a26e6344781c15491ec560714553c868adda6163688d1351

      • C:\Windows\System32\TieringEngineService.exe

        Filesize

        1.5MB

        MD5

        5240b6b49c7538016899597beeddf99c

        SHA1

        a3fd1259ab6999d84e668aacf69a7f660756c592

        SHA256

        e94ed60c76979b175bbb3a815473c5b47151b3882c45f1d924fd60df8591bfe6

        SHA512

        e47a652c56ef8815c2dc8b8070894135d1df8d4ea824c26af39399a10fc68060a705e5c9b4cf0e2c4178829aaf3be40e3d9095b16ce80e76708f9ab70f2aae27

      • C:\Windows\System32\VSSVC.exe

        Filesize

        2.0MB

        MD5

        4be7b532b4e8d071c822ed8e91a56406

        SHA1

        037ec56cddc68cace366288924da1bbd479751f3

        SHA256

        29de1a4193dfb0f9eba3565cdbdfed4bc6f3a939fcfebf343b2ab9eb96e404ba

        SHA512

        8bc20f8765d74b6804122b8c895a9f3bc58ceeaf3c59fc78ac8063cf40b9c31d1a0334cecc71c92540a0f2752b53cd8bb964f467b541d1acde24c521effa8bec

      • C:\Windows\System32\alg.exe

        Filesize

        1.3MB

        MD5

        c2f13d40c6df5e7a277a8f5948f35a05

        SHA1

        0a3318e0ff38a5e7f2a6fd52cb177fe1884cefc5

        SHA256

        4483bdb7cb9215ebfc21a9dea6051f2aacde780623cfaa6764da6d7363fb65ac

        SHA512

        9d7610ccc13523969f33b5ef45e22e95c72718c0cf590ac9d2188c2a1c7d5030f61b4629cf4b014f05dd62582e19b4821790341f5eb989c0ee09942a620f6d70

      • C:\Windows\System32\msdtc.exe

        Filesize

        1.3MB

        MD5

        abe75d1c367a4cbd7e978c13f1fa7688

        SHA1

        a1f65cc78223948e6da05b8ae6334fd1dd056a32

        SHA256

        4637e5715e055de453d880d633b6f54dd58204e34a3e49f1aca26e5c104ad113

        SHA512

        9495ecc71218158f1ab39eb1fdee83e927635324177041fc35c9e995aeac3f8026f71f893e7c416f87dfe6ae93c574fd12a649cea106dae8cecc96f0281832bd

      • C:\Windows\System32\snmptrap.exe

        Filesize

        1.2MB

        MD5

        daddcf3e80cc067aaa096390b0453e39

        SHA1

        9bf4827aea86e2b7976d813a15e017c0a0686d4d

        SHA256

        d610fc1bcfb0eb96d3b23092a54f7d9b5ea1e9d3f244e714676f5c4d8b1af7f7

        SHA512

        6cfdd52e7893fa0e8d1dfea5a4cd0cd51160ae19c3c6aba935e6588c118cc1c4c4d5823263ffb760861533a641a0825826b7dffa375ad92a3c3af8f33f78fdd6

      • C:\Windows\System32\vds.exe

        Filesize

        1.3MB

        MD5

        416755b84e900519e78ab740c78ee6d2

        SHA1

        40b70b2978ab3b23f3d9b7f1ac17578f461a9de8

        SHA256

        0a4181f739d133c744d70614eeb7727a0d2326d3255a3be8b219447757f0317f

        SHA512

        6b9ccb5e9b2f332f9130c284cc16d958477d0720d74eed7ff5391226f4f1b37f6e28d119081f7d5f7afcef908fd4c2dd43e8e626dc6ca85a4c1b18943c96ad56

      • C:\Windows\System32\wbem\WmiApSrv.exe

        Filesize

        1.4MB

        MD5

        c26390c4d75a8c491aa41baea98a1254

        SHA1

        bede5b3de05daf853e6788376cb2c020b27101c0

        SHA256

        3f69b24bb90740412ae37e84220cb910f0d8da5ff07e64c89712b800c1f235e0

        SHA512

        20428ceed51ce9208cfbc534e432b6e5b04349c37e31f869f004980506a90b68e12c6bd7915793c60e3bccd6b0fa6f974ec84babf8374865d325f90f5b52da04

      • C:\Windows\System32\wbengine.exe

        Filesize

        2.1MB

        MD5

        916d203e4ae79f2794fe825b5fcc2852

        SHA1

        d931cb825a5a32379c643424f3ab769d196482b4

        SHA256

        226e696edddce374ff52301aa16cc7a4be66ac34813be31679d62803943a7ea5

        SHA512

        86e85b095e39dfe03663391a421690b6b92f87ab20a45be3d583350d691b2f36fb55f733eca886ba1f2e57c8a7bdd8e056062aabfe7f8989cc985c33b711a32c

      • C:\Windows\system32\AppVClient.exe

        Filesize

        1.3MB

        MD5

        fcc1ebed7870394fd912aa5acd900bcc

        SHA1

        f782c63a82925cd432fc1135355d2b487e49ebfc

        SHA256

        090c9d60cfa82c4b7e59ba1a0ea661a76ee4a7f4b8a6c7f5b2aa9f932d7c1cc9

        SHA512

        7dfd3f0b59587c3813f8a49e68c686e49eab7f5acc833d1c0a37ad32894bd44e4a50cca89e6073efe91cea2f8de5f8f2fcbddf32fd7e5541efae1ec955dcc160

      • C:\Windows\system32\SgrmBroker.exe

        Filesize

        1.5MB

        MD5

        4ab9462c6ffa175bb837e9c2202d3ada

        SHA1

        25b3452bf18404ea571810a02b8b4358af03b88c

        SHA256

        bb3b4a8ccf8a42c1c6ed7fc65868cda6fbf65940df040dd2f58cbade97dd21b9

        SHA512

        3c921a6d00a76eb0bd7a6c91bd8c4b5cf283df32c41c8edaf00a3143b9dbeae8c70427b9dbad229a38cb19fed511827bde99539c2f00bb4f38940280678fae31

      • C:\Windows\system32\msiexec.exe

        Filesize

        1.2MB

        MD5

        3498a412ec8c342d0c3c282d11774c59

        SHA1

        7f8891a1fcdfd9982bf28a6467026c23b24d5f69

        SHA256

        9ca05edf66417cbe63fce2c06d58002bfcecbbe88bbdb961b9f3c69b8cf988d1

        SHA512

        0f4773bb6d7a6eef8dfa8bce54ffb80341fc29b72f4ba1301b3d3974d4dccce5e96ca52dd54002cc6f302449bebfa305c69fc0b952957951d66d8e18cb71217d

      • memory/436-127-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/436-238-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/456-250-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/456-130-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/968-200-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/968-212-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/1196-141-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/1196-263-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/1196-481-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/1224-19-0x0000000000740000-0x00000000007A0000-memory.dmp

        Filesize

        384KB

      • memory/1224-12-0x0000000140000000-0x000000014014A000-memory.dmp

        Filesize

        1.3MB

      • memory/1224-111-0x0000000140000000-0x000000014014A000-memory.dmp

        Filesize

        1.3MB

      • memory/1224-14-0x0000000000740000-0x00000000007A0000-memory.dmp

        Filesize

        384KB

      • memory/1692-1-0x0000000002320000-0x0000000002387000-memory.dmp

        Filesize

        412KB

      • memory/1692-0-0x0000000000400000-0x00000000005D9000-memory.dmp

        Filesize

        1.8MB

      • memory/1692-8-0x0000000002320000-0x0000000002387000-memory.dmp

        Filesize

        412KB

      • memory/1692-96-0x0000000000400000-0x00000000005D9000-memory.dmp

        Filesize

        1.8MB

      • memory/2304-166-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/2304-459-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/2496-165-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/2496-62-0x00000000001A0000-0x0000000000200000-memory.dmp

        Filesize

        384KB

      • memory/2496-81-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/2496-68-0x00000000001A0000-0x0000000000200000-memory.dmp

        Filesize

        384KB

      • memory/2824-384-0x0000000140000000-0x0000000140136000-memory.dmp

        Filesize

        1.2MB

      • memory/2824-161-0x0000000140000000-0x0000000140136000-memory.dmp

        Filesize

        1.2MB

      • memory/2844-509-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/2844-247-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/3060-272-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/3060-594-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/3220-489-0x0000000140000000-0x0000000140182000-memory.dmp

        Filesize

        1.5MB

      • memory/3220-189-0x0000000140000000-0x0000000140182000-memory.dmp

        Filesize

        1.5MB

      • memory/3380-484-0x0000000140000000-0x00000001401A3000-memory.dmp

        Filesize

        1.6MB

      • memory/3380-186-0x0000000140000000-0x00000001401A3000-memory.dmp

        Filesize

        1.6MB

      • memory/3736-491-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/3736-235-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/3800-214-0x0000000140000000-0x0000000140170000-memory.dmp

        Filesize

        1.4MB

      • memory/3800-113-0x0000000140000000-0x0000000140170000-memory.dmp

        Filesize

        1.4MB

      • memory/3924-85-0x0000000140000000-0x0000000140170000-memory.dmp

        Filesize

        1.4MB

      • memory/3924-78-0x0000000000CE0000-0x0000000000D40000-memory.dmp

        Filesize

        384KB

      • memory/3924-72-0x0000000000CE0000-0x0000000000D40000-memory.dmp

        Filesize

        384KB

      • memory/3924-83-0x0000000000CE0000-0x0000000000D40000-memory.dmp

        Filesize

        384KB

      • memory/3952-52-0x0000000000C80000-0x0000000000CE0000-memory.dmp

        Filesize

        384KB

      • memory/3952-51-0x0000000140000000-0x000000014024B000-memory.dmp

        Filesize

        2.3MB

      • memory/3952-58-0x0000000000C80000-0x0000000000CE0000-memory.dmp

        Filesize

        384KB

      • memory/3952-164-0x0000000140000000-0x000000014024B000-memory.dmp

        Filesize

        2.3MB

      • memory/4056-226-0x0000000140000000-0x000000014014B000-memory.dmp

        Filesize

        1.3MB

      • memory/4056-124-0x0000000140000000-0x000000014014B000-memory.dmp

        Filesize

        1.3MB

      • memory/4520-25-0x0000000000580000-0x00000000005E0000-memory.dmp

        Filesize

        384KB

      • memory/4520-34-0x0000000000580000-0x00000000005E0000-memory.dmp

        Filesize

        384KB

      • memory/4520-123-0x0000000140000000-0x0000000140149000-memory.dmp

        Filesize

        1.3MB

      • memory/4520-31-0x0000000140000000-0x0000000140149000-memory.dmp

        Filesize

        1.3MB

      • memory/4616-593-0x0000000140000000-0x0000000140166000-memory.dmp

        Filesize

        1.4MB

      • memory/4616-257-0x0000000140000000-0x0000000140166000-memory.dmp

        Filesize

        1.4MB

      • memory/4660-87-0x0000000000D80000-0x0000000000DE0000-memory.dmp

        Filesize

        384KB

      • memory/4660-98-0x0000000140000000-0x0000000140159000-memory.dmp

        Filesize

        1.3MB

      • memory/4724-37-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/4724-46-0x0000000000540000-0x00000000005A0000-memory.dmp

        Filesize

        384KB

      • memory/4724-48-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/4724-38-0x0000000000540000-0x00000000005A0000-memory.dmp

        Filesize

        384KB

      • memory/4724-44-0x0000000000540000-0x00000000005A0000-memory.dmp

        Filesize

        384KB

      • memory/4908-215-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/4908-490-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB