Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 09:37

General

  • Target

    2024-06-03_6e80d0f86ed7c92693a4b2ab9c4d621d_bkransomware.exe

  • Size

    712KB

  • MD5

    6e80d0f86ed7c92693a4b2ab9c4d621d

  • SHA1

    36d562a3855059aff1f044b50c3866d60218f620

  • SHA256

    3d2bcc511c5ace5c7f69605067a0d894f7f02990fec31850df5598e173abca82

  • SHA512

    6c4cd245ccd0188c59520c9fd02df39bee0eaa714034b70d9955c489761ada563cb6945402f6b7147148dddc0c6b4d8643081a1b9b146b546b518fdb3bdc4f7b

  • SSDEEP

    12288:vtOw6Bao6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:F6BL6J17W8CX32+KJNA80T

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_6e80d0f86ed7c92693a4b2ab9c4d621d_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_6e80d0f86ed7c92693a4b2ab9c4d621d_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3660
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3032
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4508
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1176
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5024
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2904
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5088
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1984
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4308
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2860
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2912
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2388
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4264
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2436
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4752
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4424
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4496
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3440
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1464
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2220
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1124
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2812
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1828
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1088
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3684
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2816

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

        Filesize

        2.1MB

        MD5

        514457d1f694305a8015203c4f9eabd1

        SHA1

        674a771baa5772072c171fb7dab3b71b5cc19616

        SHA256

        be39e39779cf63cc08c80c8711c571e8b93600fa453f14c7ae59e243de0ba075

        SHA512

        ceb855727deab76f954c726b04dabd4f83aebce488e3f27e9892d814b8bf6bb4526aff9772630ff99a7d45e1d3751f896607b565bd3744d06d499de33867f1ae

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        797KB

        MD5

        981b93a83256867a340643125d3c1a94

        SHA1

        f8f972b0a41fce6e8a577704daf603d7803a97eb

        SHA256

        7356ed066de76e990854252b1b578438381ea3e976d3588c5516d7b49e7ed0b7

        SHA512

        af9f4242691809c5f93205ef337225bf41ddc31f2b9af089d217d586eb7a8bb1d360410dce5dc315fca976b396ca893954fb19ad92c807fac0aa1c8161f39cf9

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        1.1MB

        MD5

        4dfb844d31311e58dded092acda5bed1

        SHA1

        03c3cbc4de8b34f71b15e27e3e07a79171da47a2

        SHA256

        6e029d42e4d436ebce36d8ff2b4827285e7df46ffcdb949936d721fb4db84334

        SHA512

        341378759a885cbb78ace58331890b64554fe5c777f099686dc8b0e084c2edc6a28ea577bf9cc720d349771d07692a56848786b5d8ebfbb4b0748f4a457b103d

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        1.5MB

        MD5

        9e391d401b59621b8b4d77cd404d7ff9

        SHA1

        9cbc482dac1a5d9fc3b8b48392f10ca606d745a1

        SHA256

        fd932dc6ac23115627d15da23dbf02dbd98f4ba41f1feab920ac9b783ab3727f

        SHA512

        52379d704d7286a8493ac2d53ca4a9864751ae722ab90566a0db9dad17fa12c7a0c276a2f4b63e03fb5a2c6ff6913544c1148f0c5f1ac2c22415e57d481c3b9c

      • C:\Program Files\7-Zip\7zG.exe

        Filesize

        1.2MB

        MD5

        a2759694ee620e404e918355441b1413

        SHA1

        965aecb4978ac55bca4131cda6a76c5bc88bf156

        SHA256

        a6fef90c8410c976c0dc1f983e1d9a999c43e9a8ad70bb8a82d70de81fb27a4e

        SHA512

        8846da5d5f9e144fc9f2f3ad2709cb2cae6e2e44e2a7cad90209d495da3e2fb1b9e362fcd9353f8dbdfadaf81a048b0111e1e4bdb168c95e31e3ce390339f41b

      • C:\Program Files\7-Zip\Uninstall.exe

        Filesize

        582KB

        MD5

        8c475618c6b91b917250c7ff00d0dbc0

        SHA1

        585e42b45c1de1868c4a51656c82a9a9a01caa1a

        SHA256

        98ae69890e0cdb545086e95c8dcb08d696eff3ab901ed306d9a309fa7d915eb4

        SHA512

        b71094890d920216617f4f7a3dacfcffca62bfb7573185f4b80fdceb628222deff295728bee6ed71d3c923cdf7e894ca160d30c7950b6191724c51680dd6a7ad

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

        Filesize

        840KB

        MD5

        3190d7eee5ba39533208429b287e4d50

        SHA1

        faef7a6f7a1a77b349b7182f919ae38a2072d339

        SHA256

        e62ba2906d06a4e8e1bbfa2b116f6ce612b9c0fc41ca28f51ca0dbb06dd1972e

        SHA512

        5f7d7c043f0e976c72d6d6e8500cd3549d9def1ca2ac1fc43490d2457a5b2bd3f51920df687b8bfd7a5d5c09d7e5ce5034d7125ce5bf5473535486014bd2190d

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

        Filesize

        4.6MB

        MD5

        d9b0178c2a140ff777a642231135e62d

        SHA1

        b24b1b7530fd3815034b7491e507182832e259b6

        SHA256

        3fe8603e8e55e76db32c8bafc0ee582bda6069d90d666fdecadea55e63cb74f6

        SHA512

        34366132e9a5329fb47f18c216434128bd4f99aefccddc02686a54a06d7bb76a222f87fa01b1be93ec7639e7c364db41c1a4c5cb63e235c186538ad94379e0ea

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

        Filesize

        910KB

        MD5

        8db3bfa221b51655747b6064a4315f1e

        SHA1

        59233dc9a40c9c86d256edae282b5548c06f9b58

        SHA256

        2d887ca37c799c5b512f6dbecc9e1e61122dafba346ffd8a0208af4a7d634c74

        SHA512

        4e9a893906893216e62ab3f56212be8807cde413e2c9af3103501bc0f6c7d8a2082689ba10b0759bdffd9698e7af275db1babc01dd23f6341ec50944e373228b

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

        Filesize

        24.0MB

        MD5

        8a6f5101b5e49972293d8060b30b614d

        SHA1

        25635b9cab931bda89ea5da0bc105433715ba6ec

        SHA256

        1334fa7a6c9267b387f3f9afa5f2e2a214f841020f21ae7873f812eea8adea44

        SHA512

        fcef91c11fa9676f0ec070b5496823cb3ef40f39a527e39d76d81edd549161e85c0a41538d0c5b9dc6973bd84308000811ccd49fbd03a48375b78379f13cf244

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

        Filesize

        2.7MB

        MD5

        34dcb7b865b759a971b6261939687653

        SHA1

        df61a4435f99a2209a336e0bb58beb87a30f6bcb

        SHA256

        697a12f08da4a2ee2eb05cb24a06c87381efab3c8093afe8eae401df42b11162

        SHA512

        426df87b933cb94182d9dce2e39f129556d9a57b83f9495333f1cbe79466fb0717d3b965d7b884f9038c9820c25295b68383318508e86d0069140f4de86f73d5

      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

        Filesize

        1.1MB

        MD5

        040dc588e024135f2d9a1e8ff3c3f42c

        SHA1

        f2ca34dec7800112b76d5c63df4f34b2d84c1252

        SHA256

        d3a9c2bf80ac9a2b99a3e921e3f72cb8295abdbcec23ca82c4339873355d69fb

        SHA512

        c6338bc783438b0581f753dcebf5ac394fa3996d9ada444769c9c08f29f2c9aa2d3c757eae85478a9f04a205be8c9cb5e625d49b0ff692e6e9de84dd92e59dfe

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

        Filesize

        805KB

        MD5

        a94d94cfebaa25e0a554a0d63432acc1

        SHA1

        e104501ffb18d904e20174bfa53ccb90a149b664

        SHA256

        61e43297f410c00944739d6df75f6035fb20b413713c7524b804b8e24e62a6ea

        SHA512

        359d71bd594356777872e7e54ca2a572802d33a9ecc9c4edeb0af827275750b2f93ad2b0ae4cf3145e01e5d2d4a1badf1d0eb5f5f6f2d2c1c98111584522fb9e

      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

        Filesize

        656KB

        MD5

        663a329a5cfe380902f8ad1f58eef1e1

        SHA1

        c84dc422782ec994e4ae1e588327a28a8026d8cb

        SHA256

        1d9287652309c7776ea67413d3e7d510b6e8ace076050128b32f6d00b26294db

        SHA512

        8c37629b49d5faac7ab099c6f1b429ed3bf79386d927ec8fa90701c529c1bb25176f0b5111e73a0dde5e1ab2fa64d78c20951e8b81a7f57e80c023ad61c0468e

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

        Filesize

        5.4MB

        MD5

        a7dcb25b1d3d81677a2ed401436e1df7

        SHA1

        838be24a95ac6052a48515127650f5fe34223519

        SHA256

        5fdb2124136539bbceb592a327d8ed62bff10b91b9a8f027f4b229c0fe43e8d6

        SHA512

        ce3f369a4f3a618da0e520c0840d6529c2602da45a5068e2fb022b94f6e8ba88fb1b7bf7ca2ff66a125414c8ebb7cf9a3fbecdacc25ffb7c099e08aa8b536134

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

        Filesize

        5.4MB

        MD5

        9d0c9d0c74afda9f2fdf7cfc5d2f78f9

        SHA1

        04765ef795a2fa42d8080690bbe9946d78c237ef

        SHA256

        eacf2e8d4e9f26780668973d0cb9a170393e41186b9835333e76b667104f6368

        SHA512

        7f588c9ff9f0a56f422f9e3c9b0ea0f7dd640a4013394fe5cb8f1ea2fd51e627a52027e0bad23209099c66dd0410cc8c1cdfbe5f33e73e957d59ff3464cfb297

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

        Filesize

        2.0MB

        MD5

        21febc2ce2747a1cebc9ecf2336e38d3

        SHA1

        fe91f1f8a846626ce1d562e1e9e626765401ecaa

        SHA256

        cdc495cc48a65bef2d3ee23bf76429fbbdac2d67df90c46ddb82e6a323e23f9b

        SHA512

        d84f5d8b7e605d9217de8ada6ee980fcf1d08026553bb8e831bbfc7c0712e17484a57b83b14b924903323067b4a525c721369b2d24f183352726d814b2b93ca8

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

        Filesize

        2.2MB

        MD5

        b10a54452de459ff6fe132908049c537

        SHA1

        8eab1a2f9f2b544ae22fd5024efc98498a13f836

        SHA256

        fb82689c93da3648cdb3b41aa84331532631ee5cf230839eb9b3058c3a6a92aa

        SHA512

        6b91fce7badacc0960dbf0592c03b7c711390d403820fd956f81ee8b128ebc005c32e62c83c2691e91c3c12a08e49226fc096fd814fa7feb06ee8dd5a2172e3a

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

        Filesize

        1.8MB

        MD5

        5a63255f538608188eec6f24418f5aac

        SHA1

        edd743cac67eddc112395226d022e42e60c30676

        SHA256

        0687023b8371e5244f25b6265c89aa065abb277109f1033b963cab354e4c961a

        SHA512

        4ce5e7a3c513728a802c2d3cfb5f35b607493a1bf555db37928b73853214a9cadbd16c292729ed3ee5d03a8b0f1aca646a07d399c5370c4601a9f9dd80132d75

      • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

        Filesize

        1.7MB

        MD5

        c53afa79bd919aa2db6b09db5b4e12c7

        SHA1

        25b17677c155ac3406b6635e39bb223a27d4049e

        SHA256

        668a711716563d98aa84dc26a5bd7290fd09f03b39024cdde1e6b4ba95b81fc0

        SHA512

        2330ecec3343a4f2f01df8f0aba1cfc2cb560208e5bdb25a408d5c4cf8854d3cd1fd0b63ad58464647e5e62e96f12c9fb8eeff059f845263a90ef741cfeb0026

      • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

        Filesize

        581KB

        MD5

        975b91abc90b06843b7a3b5ce58a3062

        SHA1

        5a5cd178d70e778dbd87aeaaf4dd93fe20875f16

        SHA256

        16e5c849ad855daa16d3e3f769517cd3fefeadcfc65e5f1622c2e82444802520

        SHA512

        5c711ba1d167b5e9e654cdef80c900d4c0acfa8abd301131d4f48cd4c665c4251c0af76489ce07bb9888cc82ff94d95c04903a0e12c2cd64322e9b8a45e5e235

      • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

        Filesize

        581KB

        MD5

        bf46a8d9d1770325f67bed9f3ea70bfc

        SHA1

        b185e271d0c7bd3e6dba9d4373d773512140189e

        SHA256

        66dcfb05a7ad46a0031fb2658f53208a87687f4114bd7a24252db197bd4f2431

        SHA512

        a4e7c30fe3dca20181cc4f845ab52ebdf9311d84cdac7af0e2b047831a2182d638a390cc9ab6385409682849cd3ba35bb99834301d70840f2a00f979cbf02238

      • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

        Filesize

        581KB

        MD5

        54552c5dfe3550b131179d71bb772ee6

        SHA1

        6411e1f0287633c5bc75389600c46bc6a6e9fc34

        SHA256

        dfb0179fea8baf9d12a33550d0ec427a0d3e590183047eca65ac0994e240b77d

        SHA512

        734cfc4b30701885e1a322e6ce5584d97b947c01e80ebaad9ad875538a994ae04db8f14dc3e5bf4e5fe61642766efc5ab239271bf611e189e33ea81983cf6618

      • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

        Filesize

        601KB

        MD5

        b25c9c8da90d9ab8b214411e5dc2c63a

        SHA1

        b6afbfe7d7bb27535d87a7c524160a6e4f7a204a

        SHA256

        051d0300ad384a7175d7f9bb0582fa8bfd5935322a219e2b3e939ad2822917a3

        SHA512

        464475d4b73150a3bac28f21f85ba769bde343292cff41023eceeca72e54f47c685fd770208159ae4b45efd77f2e767d41f0a584c7b9d7ffc4cf0856dec257f5

      • C:\Program Files\Java\jdk-1.8\bin\jar.exe

        Filesize

        581KB

        MD5

        5094e69f04b79a7414ac96382ba8094a

        SHA1

        f74167d3a5d465e02ff22760cb6856e102f0b4f0

        SHA256

        111e47d948859e23e59fddfb180cc21de14006fe2849366b61dca593313e6f29

        SHA512

        5eb297d5543c1acc2d0a3955b86931a87d700416ef14b2ffde81fd622f155931f17d2a25df87282a26a381480f8e5761a3a1f12984d294231517b76a84d07871

      • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

        Filesize

        581KB

        MD5

        0b0682e837b61de2a5699ec2bee2b0de

        SHA1

        eca819ec7e4743c618f3ccddae16d3410fe480a9

        SHA256

        e0d1e63d92377e809b60820161be8562ae030dd1d5578d18839d32602bcec2ad

        SHA512

        e73e22c4f7faaa75f76a32259b7266d4c71c6cb7772914b3905814c2970e5c7e18607844b75f9f8406b04d5a1de8a1580ac88f3983fecc88637c998cf2c220c0

      • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

        Filesize

        581KB

        MD5

        b9b986a9cd51326a7229fbcc1edf542c

        SHA1

        46cf1aacc20ff432dd1ac4f9e3bc6f309239f460

        SHA256

        ed8da8738453509b3f47d3f654c8eb57ca14757d4fc1c716f4ebbb36892be7f6

        SHA512

        53c633334721915039259b54b2e1cf4f41b2fb218de21feb4a72d79f89f3ed707b70f621ffc0d5085e86c40cc37e830fc2f20ac6d055235d1ca5468952357e34

      • C:\Program Files\Java\jdk-1.8\bin\java.exe

        Filesize

        841KB

        MD5

        b4e6ce607f397d17d13ee596fcb652fb

        SHA1

        3dad85b055c53d3699c7760a48b0e3ba76eb2cf9

        SHA256

        02e65e869d3ca59fcb43fc01d7f2cd102e3cb7e6cfb72ae9e4f8bcee10610ff4

        SHA512

        8ee6fc22b97e2c82a8a980cd4a34d879c9de333dab138ee1ac7dd0b488679b1692d569701ccd5d2984b63ad0b5fc020f8d8d027c065104312a3e61cff1190574

      • C:\Program Files\Java\jdk-1.8\bin\javac.exe

        Filesize

        581KB

        MD5

        9fce6659e3f5a2b7485ca83b8c39158d

        SHA1

        5524ecbbf8063499ce7a49555485a27057ffcc7a

        SHA256

        9801fc9f0d06ba4857984450158c475090ed367f6b6394ba7f8c71591346626c

        SHA512

        5ac88549985e62d7c58ee924ee293b17528f1249260dc153f68e995844740c45035b7da18eef40f5b2e27b87534037b017ce03c09ae37e623b0ed5f80f298dbf

      • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

        Filesize

        581KB

        MD5

        2399a84fa3443aa5dd353236def992f7

        SHA1

        52a0d6c49ce5ad4ecc516fe60078b206ba88a0a4

        SHA256

        00e169324f090bb1c40d1a0aff8c1e4395dc1c7a090b8412269a67d92a50f3d7

        SHA512

        05ac98eb85f499bf37356538c823d9a03e5737053f105c758951153b2f7c971a3f246781d2b0372276fa10831924fd56eb65d5c57a11f608b214b828efb868b8

      • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

        Filesize

        717KB

        MD5

        5215a8f599aa8ca0d67aa7227caed591

        SHA1

        6014dbd5ef58eb4349af3fc22823415a7c591d7f

        SHA256

        d813a5b2cc86a452d814d70e60a2831409faac9f99d743897fe19487e80483de

        SHA512

        07cac22e15e31d052908fd3c7149beec6140e78203dd84c2d05c18e8be59af799ccf2c61446229f9154d0a73f19d8c392091eb7d5c35486cf306448c37625e6d

      • C:\Program Files\Java\jdk-1.8\bin\javah.exe

        Filesize

        581KB

        MD5

        dd1f71414cce7199d8882c60a85ef973

        SHA1

        84a28a01a8d89967ed1ff3b375fa093089e6c685

        SHA256

        8988a801e6f47f5b5cbee9ff0ac057ba854b7029cd336672b7a5190668b8807c

        SHA512

        e2422da3e85c0e91eb66a11cbe11a6629be1654c3ca48d78737e3854b9dc315f12ae7eb38188a3be8116ea49feaa1b1a88f57591e2e8e907887c0012cdd435fe

      • C:\Program Files\Java\jdk-1.8\bin\javap.exe

        Filesize

        581KB

        MD5

        f2b5a129f122d9267098ba10afa34d78

        SHA1

        8dbe69578743a8022c67b32a0cd6cf1ba79ede9a

        SHA256

        ab2db744e6fc946b7afd603822d76a6b4dcf0c3f9991d1e9443017a72d78ac43

        SHA512

        1471dd4f976421a0b338371bfc3b63c511afcd3dfaba185988e5c18182f830ccb36c8ea30004326b90e23d6feaa58ddfd3577ef32acb1109f4e6973eaca90a00

      • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

        Filesize

        717KB

        MD5

        d15580d92aac6b9dc5e06bce72d9eb4b

        SHA1

        a390aa94298d474d8f62d5eadb058f0ce14dfa06

        SHA256

        bb87437aa8fbd7f7df8a80e10f0f6112db3288cff34b3084a7d0ee0fb0a2506b

        SHA512

        1959ef2fcfb8e711d09ab9fd4f9bbf8b4fca01685ddd3b78f734eac61bd1e4315259ccb09e5f9ec34aac944a1745e2ccd0c31fe3919f0622b98c67d1b2c74091

      • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

        Filesize

        841KB

        MD5

        f352efee7d623a11bd9392c17c3b89e8

        SHA1

        aa89ea18c89ca7164d01adb9d62378c0700a6fa8

        SHA256

        9d688a99719a3a5824bbe1a8f1533ef5725f22b145fd483b6133182b37f78c11

        SHA512

        9d04579ec90e7d06d04451ab750689a50ccdd807ba7cb9d3624140b1d8080281f944d91119d6501e35912842b4c94ee4759aeddc601c5b7e09ad6c4f02be9824

      • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

        Filesize

        1020KB

        MD5

        77133ed7cc1056127f023c82345cd4ff

        SHA1

        cdd02c2d2f5b5f581c4f3778949a9df313aa38ad

        SHA256

        b0be31a2f6acfe189492a984067c92796ede5bb317e5b2c9940f80271e9cea12

        SHA512

        4017eaa23592586e5c35d3419caded99ef6d121e41d43f6c9dc6946b8114fbb64b9991a9d2426e580139d25976016f8a267d980c9a6a8003cda4eea879750d58

      • C:\Program Files\Windows Media Player\wmpnetwk.exe

        Filesize

        1.5MB

        MD5

        e11e2dbade9366d1587ec74ec1772234

        SHA1

        e04ece526a7c17ee9c1315b46ca000a4b7a32942

        SHA256

        c2780600c6629c7d0f0b116653880e7f5e3f5a3a222305c1856981ec5e32acf2

        SHA512

        e7cfa7aa642ddae5aefdae98f4c8bd2204fdd1cb9c03840eec26342c7951254ac948b3bfd8148b62d0af4eaced2d447f227e630c414fc9acc1f524f61ea105b1

      • C:\Program Files\dotnet\dotnet.exe

        Filesize

        701KB

        MD5

        ccbd6cf06a7a7ece38997ade9adf8755

        SHA1

        7ddcb12de2f5e429a1637edcbb9e5e178b357777

        SHA256

        e240549820b8581a5c0630850354553aa26e118c7aa0cb959c0526307c0f7127

        SHA512

        f3048909f2b57f28bf5384d74c417bf388a2b7bec3aef84bb2199040fefb2aa78e30ca7cdea72a74f355e4fa0a6e6688ccc4feb8b23a2ddec7d4aecb5f7cee9b

      • C:\Windows\SysWOW64\perfhost.exe

        Filesize

        588KB

        MD5

        1fc72e591b63e14594011ffc7bcf169b

        SHA1

        f7f78690de0beed405f1ec4ee1d8177af567289e

        SHA256

        edfcf34278c18c12dffa24b6c61edb582aff78bcd6247771c97e93a61889213a

        SHA512

        422a69d92a21f54f229d451081b6b7571ed3d8907aed57fe53ed7fa548fae23b768ca20bd88096bf95c955bd683dbce415fb5fe2b8798178beaad35da744148e

      • C:\Windows\System32\AgentService.exe

        Filesize

        1.7MB

        MD5

        297dd129d638e604af9815acc5b66554

        SHA1

        dbec086e35c5fdbb87c44e6206df3c0d49ecbee8

        SHA256

        1af3db78a9c6ed6e47835fb488d1e5a781cd7a7b850969fc9c68b31a39c18179

        SHA512

        3896c6cd0abfc877be3b3179105e8745bbb9c1e60bc105b0194f00bc62171f9fc567a98e066796be697e1aaae956dbec600a969910f645980a61d498156fcc7b

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

        Filesize

        659KB

        MD5

        e391feec37fc432cfbe5737c4c19cb56

        SHA1

        ef6964b739136968b09d8ead3420d478927f7182

        SHA256

        c4f3fbfb8e813a2b35327a5d3e4ded25801ee1d25f6477156860e1ee694cd69a

        SHA512

        28c30434c733e34423f20679224248b079b226e1b8fdf6131747b2f276ea8af4fe89d16251c9b9c35ada09d5c9705eac997a6cfc9a5cb3657ade426c17d44f2c

      • C:\Windows\System32\FXSSVC.exe

        Filesize

        1.2MB

        MD5

        78a86730d953f9af89c6d55d6b8def87

        SHA1

        d444349fa31358d535a2247e9bf9dd5443de7923

        SHA256

        1ce92bdbf7e20a32068f0db44dbb54d0814d38a671b9a9b607fc97d9e003f9ee

        SHA512

        15d0a1156029d1e70018a6b0ae6e9a0511fa31eeb45351532811aa8ad1306878432c742fdd0d7f11d689751bdcadc0768861eb6d0c3f9c108b160d42cea2bcfd

      • C:\Windows\System32\Locator.exe

        Filesize

        578KB

        MD5

        03c8e78742def565eb1135879cae51ec

        SHA1

        69b4d4f1cb97ecca403eda8ecb65ec7157b18902

        SHA256

        d3957779144d361c9a32639d4a3cf691d5c488a586f8446418bc26ec603b865e

        SHA512

        84f82baff0ea21b3d6a91f5dd944a313704313f162a52b3bcdaa13807ae97efcfb8f7f30cc6d63a7b3a7312a04178d58c95f2a8abaf4d196e1052bbb8ffd2754

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        940KB

        MD5

        c0f7fc10eb13c98f12d920acaf36f2b3

        SHA1

        fc74393e61b0fb936e5df0c94aa7ece7b5235404

        SHA256

        8f41739d27fa31aa374469de348da671539aa96e7a2b44a7177046eff2f3eb37

        SHA512

        d7082aad4b559f1ad4f0d32805196ecb1956e91387367ac9b74f16211eea4d91708f5bfc411886d78cc85fc855c8fb1ad7bca316d5ac54731e71b7e7ed32bde1

      • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

        Filesize

        671KB

        MD5

        fd3399af43fa1fa9603cf9ebcc701036

        SHA1

        616d2dfdcbff181ff88f15cf1feac940e1e10598

        SHA256

        e99756cc778ed7ae5e596f727a7b6a2d116ba6f4ea25b7044a954e52bc6d7bcb

        SHA512

        729cf830415ccd4e474467c39ee3c537dcff45c77af52f0cf4567cd7a92bd68a014ffbc5c3c6e0880d8562cdd026884d3f45fd7e629cbe18b3ead2084e0f5329

      • C:\Windows\System32\SearchIndexer.exe

        Filesize

        1.4MB

        MD5

        35edbad2fba52b77b994e041acb90e17

        SHA1

        aca649f5d56232ed498ff4f94286b7f7cdb3edd9

        SHA256

        7b50bf8879a104772eca56efb8f3308b85e0257008f65a64e41ef4d18c4efb3f

        SHA512

        a18e5c847b9aba8b9a8d2cea57854ed7aaa12f169adc90c17ff776b59c631c8c7cac716d0635227be953a6a660facf9c2dc50f2fd010078d06291aac26394ce1

      • C:\Windows\System32\SensorDataService.exe

        Filesize

        1.8MB

        MD5

        60dd325749ddcfa8d373a4337cf31e98

        SHA1

        35976f9819a0194dec930abc5abbbe3b83411862

        SHA256

        0eb33c2f307d0412b94a6c2b55dfb5717d14d0d6939b18b54f053e97b4676aaa

        SHA512

        45a90336f020e2ec3bb424386af9cca0a88a985b5fd5f8ffd749c396fcfd90181f6d40d332c906ba3300ab9b0d02aaeaff782854db5743465549bd5701904fc0

      • C:\Windows\System32\Spectrum.exe

        Filesize

        1.4MB

        MD5

        5208a98329cd23863f57769214ace524

        SHA1

        5dc042851530c95969310b16832c7a3404f7383f

        SHA256

        b8d0a0a7224296c829379acc28c4572c952acd2d322064619a7c89ab30c645ab

        SHA512

        42ef5a22f6b4b430b8f17de6e60186dc9efa417ac5a946932b9463d2277d1b998802e9494198f77ff5d1dab7fc29a8045d50fff5801501c19b893a95b6984aa6

      • C:\Windows\System32\TieringEngineService.exe

        Filesize

        885KB

        MD5

        d4ec3e7aa0c14399cb8d5888291f1677

        SHA1

        6b068f5f044e4068112527e73d2b8def3313c5f9

        SHA256

        88d337f57c00e582e6b8ffd8e01f6b17862ccef4e9f05c30a94b141958ea841c

        SHA512

        b60f20d09c324f25d3fd04e2a0fdabf9a844882d59402bd2618b9f57d2938ba22cb6a7dfab2c8ca11500773db4835778f126845cc171e43a74a189b2098a2f1b

      • C:\Windows\System32\VSSVC.exe

        Filesize

        2.0MB

        MD5

        cabba41d25fc650ca9f126ab9a56d10d

        SHA1

        74e9d80a05ac6f5d5bba395cc16bbc3eb754b778

        SHA256

        14383c34c0aa5884d288da9977accb06c6c463dac8802f537b98e3bacb018e3e

        SHA512

        0d1d46e6e6cd36ce1a6562620fc451b947e7be76d3ea492a81c3b16d276e448c3773103939e9d2ea0bdd1bbdca2c7423d700da107bbdace359debdddc8a76d95

      • C:\Windows\System32\alg.exe

        Filesize

        661KB

        MD5

        607d941aeb446756a9a586ee3b916b89

        SHA1

        056cb26e4a12d0344351c9414e0fa1dc395430a1

        SHA256

        db3f496d343afb4c1d8216c119b357b0f60e3866a2d40f23893ecbf50693be13

        SHA512

        443d4ec0c814fb1c4b1d484d906a962affac9cef127e1dab6514ced983c6bfbc0fb81db661e2b000885aefe1e7595c2d4567e90b9beb24eebca720ef38712c95

      • C:\Windows\System32\msdtc.exe

        Filesize

        712KB

        MD5

        58e146bd214fc96ffcccec3b22732166

        SHA1

        0206d272c56b05404242767057bbc26633d5ad6e

        SHA256

        a28b32cc6dd6633b0d8b523004fbe2150b2b773b55bbc009eb2657d80469887e

        SHA512

        25da84eaa69d75bcd8970ba0afc11718d3099c2decb55dd2261c552e2c0a632065877f0c3aeca6b05f1933d37853f22baacfc235338751059c6c3be1148ecb51

      • C:\Windows\System32\snmptrap.exe

        Filesize

        584KB

        MD5

        7228593e02c655cbe47fd32a29573017

        SHA1

        26ead6ee32d860b3cc51a9a895d082e4408b3b84

        SHA256

        515a8163f951685615d2bb7d37d19dbcdfcd12409c41ff6709ff6eb980b79ec6

        SHA512

        920511c7d4a595e616c960f01c43312d8ea0e34aa94234d3cc8569d8e7053545c93a020c389dc3364424b12adcf11068f705c80771aad739ddaa4ff464eadda4

      • C:\Windows\System32\vds.exe

        Filesize

        1.3MB

        MD5

        ff78fd9d4272e2d8c18d6318926cd7a8

        SHA1

        abe3afd81581f95c09a5f25df9f5803f609ae220

        SHA256

        c3432512ccfb04dcf1d7c2c9285e8f656c6b2dd9f2c2974ac62c47555b711ab1

        SHA512

        1a28dd1b4a84a5fc24981aa4a7fa42def574105243865c287dbec07707ef0acaaaed9ca8025948c0a78e03f904c0ce01e6c0cea130e282a961eb702d44ec9f90

      • C:\Windows\System32\wbem\WmiApSrv.exe

        Filesize

        772KB

        MD5

        0bf4c45ee1339bf31e0766c4ae86ae32

        SHA1

        79acf4fada72305043a10cd8755e1f2f3cdcd8c1

        SHA256

        5b118b9c8f421149831e0bbea43a4ba581a51e85d7753d29b1b12ef03957accb

        SHA512

        c747ad1e608c9966c2ff353052c4392e2212b02efe933cc0a1d188df33bbc17e663f5c7649e3ef19ecdab5c77c58eb0a0253c7d0fd0fe80ca64d0c02f6540cb3

      • C:\Windows\System32\wbengine.exe

        Filesize

        2.1MB

        MD5

        86ccf5c15d163073b5c24db54c32f691

        SHA1

        405b58fed6a2cb7fd4740eedd04f9653d108f97b

        SHA256

        3998448026432fdaeb4beca6eb084197889818f6693f2dfbdcbec9880298b37c

        SHA512

        19f174d7c4be7474b33921103ce2dbdee098ca6fc2a4bb3fedf89b91ad250869e96fb0f33126b4d1107c07c28d107ed9c08f7ef1bc0766605d4d9a38c98c1440

      • C:\Windows\system32\AppVClient.exe

        Filesize

        1.3MB

        MD5

        0dc6fab0ef238152abf4c96600b1b196

        SHA1

        1783027737be9625ae46fe516a0ad141d7f8bd8b

        SHA256

        fd92e05c5d81d794272051ff1c43ddbb24b3ae21092ee750d7180b7c435331c3

        SHA512

        76e6a49abd11bec9dc65f8b719c83848cf37a8557fa039f2b541e48105a1617f33471a0368dcc8cf26aecbc966f66b6a19d50acfd2d4d56bb61c6f6a7ebd0a2e

      • C:\Windows\system32\SgrmBroker.exe

        Filesize

        877KB

        MD5

        31191daf6c88eed0419719590cf33add

        SHA1

        d16613b126fe2ab51bb49079cf4ec0677124bd3f

        SHA256

        7a51312c4e875a2b99ffc56f4b8836ad96c65f2757a92be9ccd304c0244ac590

        SHA512

        d0d1c98bba704c007e7fbc5e0048bc6e272837b3e9bff51a796122dc368b5c46776bba1f7e8ff49717dc4cc6695f4f09274f25eb629fb927abad929009934e19

      • C:\Windows\system32\msiexec.exe

        Filesize

        635KB

        MD5

        36750438e25a3b3994e683215d6fadbb

        SHA1

        68d68c9a08241200c9c0ddbeb0fadcf2d543e8b5

        SHA256

        91807b132f6405bde5479eee662b6855cb9e1a2f684a71ff5b69be330c423284

        SHA512

        3e2211f6a622cb2478caab1061986ab6c6c1ac96b5a70e100503494a556f238913894e11e0441c6f6f5056239ca9e6543b51aa2ea84da89068315fb330e3132a

      • memory/1088-646-0x0000000140000000-0x00000001400C6000-memory.dmp

        Filesize

        792KB

      • memory/1088-256-0x0000000140000000-0x00000001400C6000-memory.dmp

        Filesize

        792KB

      • memory/1124-229-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/1124-640-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/1464-205-0x0000000140000000-0x00000001400E2000-memory.dmp

        Filesize

        904KB

      • memory/1464-638-0x0000000140000000-0x00000001400E2000-memory.dmp

        Filesize

        904KB

      • memory/1828-644-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/1828-252-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/1984-88-0x0000000140000000-0x00000001400CF000-memory.dmp

        Filesize

        828KB

      • memory/1984-81-0x0000000001A70000-0x0000000001AD0000-memory.dmp

        Filesize

        384KB

      • memory/1984-75-0x0000000001A70000-0x0000000001AD0000-memory.dmp

        Filesize

        384KB

      • memory/1984-83-0x0000000140000000-0x00000001400CF000-memory.dmp

        Filesize

        828KB

      • memory/1984-86-0x0000000001A70000-0x0000000001AD0000-memory.dmp

        Filesize

        384KB

      • memory/2220-219-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/2220-215-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/2388-147-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

      • memory/2436-554-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/2436-201-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/2812-641-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/2812-232-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/2860-467-0x0000000140000000-0x00000001400CF000-memory.dmp

        Filesize

        828KB

      • memory/2860-110-0x0000000140000000-0x00000001400CF000-memory.dmp

        Filesize

        828KB

      • memory/2904-58-0x0000000140000000-0x000000014024B000-memory.dmp

        Filesize

        2.3MB

      • memory/2904-243-0x0000000140000000-0x000000014024B000-memory.dmp

        Filesize

        2.3MB

      • memory/2904-50-0x0000000000CB0000-0x0000000000D10000-memory.dmp

        Filesize

        384KB

      • memory/2904-57-0x0000000000CB0000-0x0000000000D10000-memory.dmp

        Filesize

        384KB

      • memory/2912-146-0x0000000140000000-0x00000001400AB000-memory.dmp

        Filesize

        684KB

      • memory/3032-20-0x0000000140000000-0x00000001400AA000-memory.dmp

        Filesize

        680KB

      • memory/3032-21-0x00000000006F0000-0x0000000000750000-memory.dmp

        Filesize

        384KB

      • memory/3032-109-0x0000000140000000-0x00000001400AA000-memory.dmp

        Filesize

        680KB

      • memory/3032-12-0x00000000006F0000-0x0000000000750000-memory.dmp

        Filesize

        384KB

      • memory/3660-99-0x0000000000400000-0x0000000000584000-memory.dmp

        Filesize

        1.5MB

      • memory/3660-8-0x00000000022D0000-0x0000000002337000-memory.dmp

        Filesize

        412KB

      • memory/3660-0-0x0000000000400000-0x0000000000584000-memory.dmp

        Filesize

        1.5MB

      • memory/3660-1-0x00000000022D0000-0x0000000002337000-memory.dmp

        Filesize

        412KB

      • memory/4264-148-0x0000000140000000-0x0000000140095000-memory.dmp

        Filesize

        596KB

      • memory/4308-100-0x0000000140000000-0x00000001400B9000-memory.dmp

        Filesize

        740KB

      • memory/4308-90-0x0000000000780000-0x00000000007E0000-memory.dmp

        Filesize

        384KB

      • memory/4424-637-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/4424-203-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/4496-204-0x0000000140000000-0x0000000140102000-memory.dmp

        Filesize

        1.0MB

      • memory/4508-34-0x0000000140000000-0x00000001400A9000-memory.dmp

        Filesize

        676KB

      • memory/4508-26-0x00000000004C0000-0x0000000000520000-memory.dmp

        Filesize

        384KB

      • memory/4508-35-0x00000000004C0000-0x0000000000520000-memory.dmp

        Filesize

        384KB

      • memory/4652-647-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/4652-268-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/4752-202-0x0000000140000000-0x0000000140096000-memory.dmp

        Filesize

        600KB

      • memory/5024-61-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/5024-38-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/5024-39-0x0000000000800000-0x0000000000860000-memory.dmp

        Filesize

        384KB

      • memory/5024-47-0x0000000000800000-0x0000000000860000-memory.dmp

        Filesize

        384KB

      • memory/5024-59-0x0000000000800000-0x0000000000860000-memory.dmp

        Filesize

        384KB

      • memory/5088-72-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/5088-70-0x00000000001A0000-0x0000000000200000-memory.dmp

        Filesize

        384KB

      • memory/5088-255-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/5088-64-0x00000000001A0000-0x0000000000200000-memory.dmp

        Filesize

        384KB