Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 17:49

General

  • Target

    2024-06-11_3a815d486f870d2adb71da4116b967d0_bkransomware.exe

  • Size

    1.8MB

  • MD5

    3a815d486f870d2adb71da4116b967d0

  • SHA1

    8fe2028ec404feb7bcb10ad8b60bbc9013d6bd8d

  • SHA256

    7acc00006902e43085db95db69bbe91a0659b65c53b22b2816b969286f886db9

  • SHA512

    b1e480ac66a0f6addd39d2db182c5e02aa54a7b6c0050938d8d31eda61eafd5f6ac7d0c28543fa4d538052bcf44a64d141c2fa6bbb3878d7c0151de2360cf40d

  • SSDEEP

    49152:0E19+ApwXk1QE1RzsEQPaxHNL65RjUV2Vo:Z93wXmoKj65tUV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_3a815d486f870d2adb71da4116b967d0_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_3a815d486f870d2adb71da4116b967d0_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3280
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:1292
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2460
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3936
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2956
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2872
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:912
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2320
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4320
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3476
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4268
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4152
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2416
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:216
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1720
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:832
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:392
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1040
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4876
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4520
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3836
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5072
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1116
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:860
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:5020

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

              Filesize

              2.1MB

              MD5

              6ae83cfbee7aacb8ef4ca9ee1a9953b1

              SHA1

              75e1bc12603a715bc9e4b5030075f27e164178d7

              SHA256

              82ad423637a027754c370cf73eda6ce98c4076f30ae59b718496645f25740cea

              SHA512

              b9dd4618ab98b8bb7833ddfccae33a1b2e525e04ab83631b33961a525a81bbb05ad0c7f7e21662cc3d647473ce6fcd40c3104a112ac36eea62a9c988f04a4b34

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              797KB

              MD5

              c29f40073080741b603615a566077e46

              SHA1

              7d3264353d02650a5f8395381e55607b649a6cd1

              SHA256

              af599a6e6b897177bdc89f2764ff5eaff616c425c5d6e3ec7ace373aee258d34

              SHA512

              aa6a54f16366e0b429eb5a27eef1e35fd8bfa575a4a760f7c41f21e7bd85be996d56c0a46a1551652de68d5b34e6a403b953ea4a9175b8b034e0ddcd1193c21d

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              1.1MB

              MD5

              7b0ae4f46e8bd438e8f9a476886e6f14

              SHA1

              9e1e4dbc5aa2922eb94f6a9997a1b17ed8f3b045

              SHA256

              32ae1f6440c5cda641b7bce41e881fc53f15b2d010e707b3f3fc2ee69d934026

              SHA512

              6ed254f678048bd853606b704d8fdb02a216ba0df3b7c4ec13ceac27211fd5369afa4917d0742539d45908827dcdf89ef7ed14b8ceed8c44e7f0d7129cad109c

            • C:\Program Files\7-Zip\7zFM.exe

              Filesize

              1.5MB

              MD5

              2136b32606ec02610dbe9812a11981da

              SHA1

              6cc71176c2443796a81b312e7431cedf102265e8

              SHA256

              6e40a71bfd827a3d5905a3e370f5f9914e5b55452cdbb757bb0b15bfdb0ddb28

              SHA512

              d7d74b8f51b6576c50d4dcdbe52a7dc495ad573d08cf2a935c06e363075316cd2b758b5686f482829c7fb69ec9f84543cf6b4e583f1e98e0cdfc53989e7d4925

            • C:\Program Files\7-Zip\7zG.exe

              Filesize

              1.2MB

              MD5

              129d92c429bfa6b3f5a8cdb81a991edb

              SHA1

              7f9f9af96307d8e06de6fa95d17822253877e3b9

              SHA256

              4330509df5e557d2d87aef46102a23d8f53ef04123604d80532f4a175e1a8766

              SHA512

              dd70a4fbf742b83ab2b44da6c8b2f03040a32fa1d5f5697af53244b80adc5120971909a965887a69ddeddafe1f914749882a0eea326502bf3f1f1bc78e980dfb

            • C:\Program Files\7-Zip\Uninstall.exe

              Filesize

              582KB

              MD5

              21c4b04b50e21456a5c45335d96386f2

              SHA1

              b68f4b3ff473a1052c7026c5d4671558f1401038

              SHA256

              87f763b095869911c8d938ecfb83eb8f7f2f6f058259290ac5d7bb0eafa43dab

              SHA512

              175c4376418395d9625d5d8ec542fb72e2a51ead69f09e170f8e405fd3bf6e24e0d5e9190deabba9ad439eb13a9bf68f1149bdf9d968ac3079d147831cbb1829

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

              Filesize

              840KB

              MD5

              3a13099f8eeef4a8790eaa782d0f80c9

              SHA1

              8a730dbc8814f422b438fe8b7e4a0e2b1d463926

              SHA256

              08d0b1e005537fc6f5ef653cee9a1cf370f4217d28bafdae25ee7436e2dbe41f

              SHA512

              abc5d5be253bfeed7399e4e7fed22ca1a6784651655382ce12479d1d176da5c2bef6e96e8c662f6d873c6718661ce3df854e2ff679e23b3c46acef19048a7fab

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

              Filesize

              4.6MB

              MD5

              9e5c1bded1ce471d393afcefc1b3f868

              SHA1

              4fb768c0ab6acb8e7d761abde6154fcd04e6dee3

              SHA256

              3cea8b2df6e4ea4c1feb758a6718b01f290f92eaa84224a7c21fa58c832207bc

              SHA512

              0583d8e25932436fd627b3d8942873f1813fa3cd761c0f046dc60dc025a4c759cfcdd0293f75c4426267c749bda8676c4b684d0f3de508e09506547de8abab8f

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

              Filesize

              910KB

              MD5

              eef2bd64a650cb110f4dbe94635690ff

              SHA1

              db268bc4e3bf61bbcd82dc4c39cea1b706673ada

              SHA256

              079ca217eaf4f1930716fff80f896a4668fc3e210e9317dbfd8777ce43fa0724

              SHA512

              3efee68bac093879c3c8998b06cd9b7249dda7a61237e7b5386d2cec82548cdcc1897584ad6099241d7b586748f50be78ee5ec7d32ad5bd1dd5c79e1815d8a9c

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

              Filesize

              24.0MB

              MD5

              4c347fc28450b0cda5a9fe0e1dbddf11

              SHA1

              582bc957ca378d46b8a4cb9c04d7204db1e79384

              SHA256

              a5d30271d36b97daa051ab17625b689af15805818f98b6a2b5f3731b31593093

              SHA512

              2878ad1d29ab33d87d11f41ca922de2fc95e7675ca1ccb5622c9319a2088a182695622c3dc21da29199f276d224bcd5d7392684cf529e1e3a71642976a5f34e3

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

              Filesize

              2.7MB

              MD5

              070fab9af6156ef812849d4cc5aa4bfc

              SHA1

              77daa0c572d05d7231a87ff9b0c33ecbbe631fd3

              SHA256

              90ac12318bbafac27e3ad2c572bafe38d236386ee5e567daf4aacf8959788bd0

              SHA512

              ffd1b4087f9d4afff8eb51a17145f775788f5bd21f82f1bbef82a0cbbb270455e656594aca0e627fefcb93671eb81e9e06122cf1fb1af800837e5e39dd17383a

            • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

              Filesize

              1.1MB

              MD5

              7fd5b06cc07ff321f7b2cacc6e4ed9aa

              SHA1

              92dc99857cc0dd408636fdb73f25f5743e065302

              SHA256

              8043adc11c3b4363fdecaf488e138c47ad2083847725172080974e5cbf173a3c

              SHA512

              59ffc1a168f31e12fe572fa7f1755c5006242a44eb248458a7a93ae75a47b761d0b3e17f9bd26c9877931c7186b38a1f906d8ac963b97f12c02d887ea81713dc

            • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              805KB

              MD5

              92f52f11c9e235f8f8b4e3b8384a4254

              SHA1

              64f5e92417b94b2e5631f24e8bd0a140e2c0150d

              SHA256

              b9c188d12a0b9afb660eda61e15aeac8773ab3acd0c2a89a3794ad05c12e5924

              SHA512

              58c48f05504e0df531899496c8cf811c7c4c86cd34785db7ae1a949b295654ad88dcd57662d5b160a339a13c1131c62053b0724c7b84604e2136150377a942c2

            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

              Filesize

              656KB

              MD5

              1f968f42c3f0a1b9727dc14c121025d9

              SHA1

              e841d3837a4c3d3b1cad707fac1c644ef80d6edd

              SHA256

              a7b503ce953691e5e5a42e288c6cd592ce78257690f9ec70734eebf3e3058f00

              SHA512

              c199b466697acb454821de6209d5257c030451f7992375c7142fcfa0a9eaf70a5d1bce2c05a81c66a67496bb29a9fe1c1d4bfb385585fd10dcf15191afb7723e

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

              Filesize

              5.4MB

              MD5

              0aceb207d1b6f9f6ed4037b6488d8ecc

              SHA1

              1daffb2a28b1e1a75ed02967530e81949ba1c64a

              SHA256

              b8de286a2bb3ab189c92a796dced3022463c5de4753ff27f055c13a249414b5f

              SHA512

              74f5d2f3bbbdd8d617ed66bbe083b26b29ee5389833b747ac28763600d020644c78db23c2a2e6a7f3ec3f021a733d17844b6cbcda57b99a5d908217a21889286

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

              Filesize

              5.4MB

              MD5

              b2d2e5d997fa27c41b1de085fdd368cf

              SHA1

              f5c50867456a859b8258068c22179399adda5963

              SHA256

              e2a15d9067afca627d7d26ea832ed2c36952443de7bd2bab8dbd5ab552e8af14

              SHA512

              c74ec795fa974ef5fd351895fb73718669940092a079d22e9e847879e932fcff18789a68196b93fc1957c2cdc9f3b1d9564a823b3e6b75d96a1e11f32d2c9857

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

              Filesize

              2.0MB

              MD5

              996dc41f70144deb4d68725178fc880e

              SHA1

              d1802e605a1b703dc8e3cf2a3b76e6d8f50eb963

              SHA256

              2025036433f066d52cb0ad14150d09512690bcf37a30fcd5e2a4f5f3a6293e7f

              SHA512

              b065f959c484e96fe64937fc4495f0c146a04bdbef95b6840eb29fb0cc7ae7815703cc35628207716587962b04d687422199eb810a73230cb5f187e51d0e67f0

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

              Filesize

              2.2MB

              MD5

              3474ffc002ea859b7764f468ba7dd14b

              SHA1

              24df538961c8fc5b12ef035e8fabc8fd0e85e987

              SHA256

              a641e5069d3fd9fedd9b0751a81c339f8a561ce872a5378ee95bfd95b2131add

              SHA512

              3b30e6752d2900282ea80514ddd26d50794ed7141bc1925bfcfcfc09d71f28a4e111aa0a851c996eea1b5f99a59f39944e0a3f77fb463ef7a9790da6400fa2df

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

              Filesize

              1.8MB

              MD5

              48091bba273355b6ee76b22392ba5b03

              SHA1

              926aa30f63329897b97918c6c712a7dc44099140

              SHA256

              2d77b8d1d3fd2f8b32d67469c6873412091d96e106b79e68d7d9f7322b56ac41

              SHA512

              bb3a7405b884725fa109291e5d499974ac9fc06119781b5961ac5cbe8542840c9f7d54691a435842a1a83f0f87dbbdf787968bdf3d919c6c6d9b947a18efb848

            • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

              Filesize

              1.7MB

              MD5

              c61ec2243c65911362bded4bba241187

              SHA1

              283702d7d2c4b47c414e80d066ae1f89a8904b11

              SHA256

              9dc9d19bcbeee212ed8e73c1cb0fd33fa3de5ae397534304c69ae82cef3d95d1

              SHA512

              3f33c0e980fc0f6c1daced6e9bc9aec2aa023019fc5ea74979da718c7abd0800eec5fbb7d0578f3970c9aa7addfbced95cc907e92c6cf19cb507403bfdb3db77

            • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

              Filesize

              581KB

              MD5

              68de9f592a2c27bc736222bae35500cd

              SHA1

              4d8064a5cf8a637fe69283dfffffa20767a016b0

              SHA256

              0d1e38de83152d7d93926643166707810b6773ea455b96f8420b7b68c12c4379

              SHA512

              45c5192646a29be595435093e82c0d741a260c3613ab8b252e39b72221b7ece8af6033635a130f8e0c13a4328e1b78acad03f92f369dea665c5b49d737a0bc58

            • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

              Filesize

              581KB

              MD5

              74c20a4b8bd70a3f2185451b64326898

              SHA1

              d97657a24d9b0813f4a279e4aa0a6be00cb57fb9

              SHA256

              923e1d2e361ce414cb4d8e9988e379cc84fe3280fae7fca1810a98e921ffe87f

              SHA512

              672babf1f17535626fc12e0cbee4f7b0d61f7657c1d76a21ea01f52dd0a6e2d73066666d1cbb980a044c9c8c5e2733393a5cd799b39f9407cd52231fa255bf04

            • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

              Filesize

              581KB

              MD5

              5010e3b19d889d8d3bbcc8ffdfa547f0

              SHA1

              1776d2587f80eb18a0b05869eb3318c93d6bdafb

              SHA256

              70014db46f4d94e149908a393a40d47ade86949334406d435819ee32c16d370c

              SHA512

              4cd89b1ea4c34768fba7845c944c67be2ecbc9f7a7c8a2ece218c3f14815f224d5be2a3df6e8a288e39ce051b933409a61d974a68a39bc06887f94877435d18c

            • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

              Filesize

              601KB

              MD5

              cbe4d2de87830cb26a6e27d40e473b6b

              SHA1

              fbdb884fd6bd434724feac72a2ceac69e2fcca2b

              SHA256

              9fc324c9d4663ae3dea1dde4a925b61fa176c68f3805eb10f7373f9ec95d3f1c

              SHA512

              be40d30b9e1c88bd9b8bed47115e5ef36f4d219fd8aaea99a1d218d1a2bc1ad2ebabae54f5ac12a7aae9e105e798dc76c15fe3e4cdf59655ec42cb260bd8397d

            • C:\Program Files\Java\jdk-1.8\bin\jar.exe

              Filesize

              581KB

              MD5

              94eb116139f8614d2b0a757653dcdcba

              SHA1

              1e7c5d59ed2375fafe91ef11f2d54fbd5a071d11

              SHA256

              eeee8e799e68f664efeadb785b4c6e585aa3ebbeb84d352eb9dd4974cc959105

              SHA512

              91e96bb390e245302711f1ebed537d003753f402fd2b8419c0e96210212be5433f779a215b5b6c576a22ead877d3e46d2b26883c94ba5f3b456a6e0ddcf218be

            • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

              Filesize

              581KB

              MD5

              b837d4b3225ba20a856dd1a69324571d

              SHA1

              3f1009795167f4f24bb5cb1bfb77e180e2784271

              SHA256

              1be7f52d2e57be3d7d951becfd0a46a43d7d92776d0f94261299d422560e70ef

              SHA512

              b082da8611623f9a95ca56a2256f9980e500420ac653f5270b59a1d6f9a4437810ce8c54279d69f505436b87651cbaf6d57c6086b0c61d7dd319079b88db1b7c

            • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

              Filesize

              581KB

              MD5

              b4d7b74a9131178202eed1f28353b34d

              SHA1

              6adc6536e565b27e2e131bdbc28b6fe704656529

              SHA256

              2d53644a7ac2177068afebf395f1ae5bbacf02ee686e01def3b84a2802ebee90

              SHA512

              cf1c8a80b417ce871aa8df535e25e57755080ce7ef316456bcb406506ec89b306213aebe633e229cf113df6cf8a047acd2859e9c3fd104d4b6cc8df153305935

            • C:\Program Files\Java\jdk-1.8\bin\java.exe

              Filesize

              841KB

              MD5

              ec98593ab74887b6db4daf878c4c2301

              SHA1

              111994403a678c3dfba31213f238e934f03242b1

              SHA256

              a094d00f2ff446dc57003ad125926dc74cd1b96d2f894269194bb35b1b8a3d23

              SHA512

              d4789991f7edd6cb5898b7f820ad656ff6e5a78be34677ac3cad9c5a8ea7493d00877c5b5bf4798712910c05010e68a0772222ef559a9d9cb0829e4378fbbcd7

            • C:\Program Files\Java\jdk-1.8\bin\javac.exe

              Filesize

              581KB

              MD5

              d9f5779c19f19bface074f76c5c0f0a1

              SHA1

              dfb415a12e67a67aef6a4a35e7a221f3ec2fe182

              SHA256

              9fcb8d7da91fd130c967736bc7ef41d944dfc4641953828c183ba6fe3f99edae

              SHA512

              de15f54971d148cea0362352a91692b65ef14b73c93f9682afcb02d61b36be5a34e90e2a1458e918cf96636b99a0fceb2e17ce6b33bd5e341aef00de3314f921

            • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

              Filesize

              581KB

              MD5

              f7a45f4a63e1c99f7ead290a060b18b3

              SHA1

              fe964e29665996ab195fc828364784fdc70fe168

              SHA256

              797dc157707f8abd5ff4892db1ad9cc645ee840f77c144c7fc83474aa9642414

              SHA512

              500407745688540fb65f1bf456d223e19688060e28e79caed80b94dccc2da9c7bb0f7587a284bef4f86984044b4a842db80b624f982e7cf07a9c7d49555402f7

            • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

              Filesize

              717KB

              MD5

              aa70d933adff42a46173d78e8f368d7b

              SHA1

              058770d49a89b2e63a5879236df7250a77755e65

              SHA256

              7aa45c6a03c68c69e4600bab2359831d7eb8f55085d1828284b26e3661574185

              SHA512

              f69c13f8f2149fbb19ed925840df5513b6f094db070d07861ae0124bfe84f80f1b9d3aedc76f0ec20ddd256a27e47899182db3d88acc583e04b7a0fb80146701

            • C:\Program Files\Java\jdk-1.8\bin\javah.exe

              Filesize

              581KB

              MD5

              ac37d7ff030e53af2754c112a1b90866

              SHA1

              56013dcdad1d4ba7d4fbc5d4839cb0d8b093ad73

              SHA256

              3ce1428cfee13f34a37f88ae3d1c1fdc1465dd8cac7a3ec1763e26162823772e

              SHA512

              9b86b03e1382513b5559b451bd2e7f9e4510fc3f241b20535f1d90e5b9c1beb4b4a5ce14c8212a8ccbdb0ddac7f93f010d4ba0c7cfd237822aaf02b36e60f029

            • C:\Program Files\Java\jdk-1.8\bin\javap.exe

              Filesize

              581KB

              MD5

              9c15ffec25a647d98c36354dba6b4ce5

              SHA1

              7781086654c8d3a94fa4465f92d04c0b42aff91d

              SHA256

              1bc075de05ab9e3150b5032f381529ef9f8428839a19fe8afd19aa8641c791bc

              SHA512

              91291f239bfc065a61ee21a496456fa46fb4dd4e349deeece90f7cd55976ec4e3df87d91adfeb891a650bef37fdc525729e770aa8fa111ed8d5db5f06551c23e

            • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

              Filesize

              717KB

              MD5

              f52ebaa06872be38db8ea9fdd5d42ed7

              SHA1

              c4cb50adede50ad9613dcb290023dcc6f740b70d

              SHA256

              0c5aed46edd8df1dfc44cdbe811cf7346e1a6d4e2ac8dcf651b75c55635b2c12

              SHA512

              15764d51a4c10770d12c40836c124ded84902a2524fa5eaf7f371f8808dec70934f466a035be90b76efd7d6295b8bd49e2878283c0d9b618b6d9a8d8ce69a8b0

            • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

              Filesize

              841KB

              MD5

              3fd4d8eb858602dffbe1aa9523b1005d

              SHA1

              dcc1851e904cdc27873149f295828502f40853a4

              SHA256

              4be537ab86c7b4f88eb20924b45104444a5c8de1d56e38a94512d9c197725b1c

              SHA512

              73345819b82c25868bd900cd72ab0dbe5e34e5c78b74920810df7332667098fad886c0db5fc98df87579579101b6b39b34acd1329eda609df22726c88f1292cc

            • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

              Filesize

              1020KB

              MD5

              b8ac39a14e31b181c14827d5f2b0a806

              SHA1

              4431dcbfd7107b44dc8fb76a26e0fbc15b08dffb

              SHA256

              1df9d4fdd2f8e416c92cdb01d97fb629e4437fd56049d476e5c969f7e587edca

              SHA512

              d053d6cb39b1cda6252baeb7d7dd217b24b462ad8eceff6bdbcfe36565f2c5e06867d8da336160189a4062fbd02153b1d6f7c28b9bddb5211cf50b1dcf49ee92

            • C:\Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              1.5MB

              MD5

              ac0004edbb9cf20063bb46a16864f155

              SHA1

              60e5e997c8c4d8b12da5522c5a98fe32712ae4fa

              SHA256

              bbe048eea6dda15b4d642d4cdbcba9328c905faee7d596df7db46c47812391d1

              SHA512

              38d04f08da50c32e769f22e262ff886ee2910f819820f6fa9b58206a0507197d192b757c9b355b1bd1c5f29a02866618a1d49fa48641997807aa974d076e41f2

            • C:\Program Files\dotnet\dotnet.exe

              Filesize

              701KB

              MD5

              ec3637a40b1ab0e2c7d48d2852ba8b98

              SHA1

              69c87b92381f5d4a64d4be908777ba9285af9de7

              SHA256

              1dd1b080acf33be96bff92d967073c3768bba7707fc4aad1d72870f4ec1ddbcb

              SHA512

              5ed77ff40c9c4e8422001ff761f75bd6ab8c94c49c80209bd3f6285d25c05d33ac9278aee808ade343b1a97af795644bc1164dd8c278316bf03f8bb3a20e1d69

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              588KB

              MD5

              3fb0a53fce37242f5ffdeb8d092d4497

              SHA1

              28ff9f3083a5b4b34247fbf546196f0d9c7cb7b5

              SHA256

              f3af660f4172b00e6e3120cf7384f9f00cff3371110350dce9fde08728afcb10

              SHA512

              8d7542959bde12457504bd267d0a62b28a24da1feae221cf3dbce36bda089e63490b1ea4eefe894a0f2d3facad4e5f057d4e75a95d6de5cc68ef8949082905e6

            • C:\Windows\System32\AgentService.exe

              Filesize

              1.7MB

              MD5

              7fb8a45d3439c575e169a353dd9f0d2f

              SHA1

              7031f43cf9d964c83b5b3c7a6997b3e98b574d8f

              SHA256

              c0c75bd9dd48bd5a21678d089d309aba8f9c70fa1667e3050b57135a0281e1ab

              SHA512

              bdacb9b80025f998184e49ee8cdd381483834d60c8b7e87174e07ab259ca4fbd0cd3d81e7934df0fb1f0db86794fa76fe9f76e2db5beddb8b7797cc0cfec5438

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

              Filesize

              659KB

              MD5

              7c0c6e356e1bf709542e95cd0a23c463

              SHA1

              ce11b78a7eb04ec4f3dd71b2838c906930e9fd52

              SHA256

              9cb0383c982679a0d6bf183f4aad4db735c0e76d90b3cec879e47a6715298e51

              SHA512

              8040fe4ac9a07ef6aeab557d3c8359158e80f265f66c22dab415144f6d22c733f6bf7b13b67f241f99221a26858df555e2a5ae3325b69ff6699395e16f069ab2

            • C:\Windows\System32\FXSSVC.exe

              Filesize

              1.2MB

              MD5

              d4a1becd3a4fde1cf29ce287d56952b3

              SHA1

              8175f5d0d5d56fdb2666098f54cae8bd3c54cf34

              SHA256

              2cd0b5faa6eb276468afc22ce099937108f3787d7c5c8f1eb32d15b745d48668

              SHA512

              f622eb0cdf34b4f641f04ef10f8e329f99aaca292208a0c440c675e77e8f40f7f201a4a3bbc0604fbbaab09fd9b08892275beeb182eee04992ebdfac0510f65f

            • C:\Windows\System32\Locator.exe

              Filesize

              578KB

              MD5

              89d74d885d0920c0d723502d76410acd

              SHA1

              f0c724ed64ed795ed8f5dee01be1d2bbae643e77

              SHA256

              0fd420625da0a1c3807ce29cc51c653b55d9f458d04749603863ab5495e1f50d

              SHA512

              6a51b14d41f5705f04262037c9ef06561367d37af29e41635b6f8800a8edf1156a27d6da1f4b8be85d4b14455ef65d8cdd796252db46d5e3c915fcd1f83ca78d

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              940KB

              MD5

              bf545e47f2faeb7e95905238bde26be5

              SHA1

              324f50e6d8435ef9abb30c29dcc086d1143414bf

              SHA256

              7043e79c2c1c5c45c65cca4d463990d1f17d36442819b70f433088f339d2ae0c

              SHA512

              b851f2221c18de3f218d4e2a3c6806e57fd6079ca810f73cf6310fc3cb74cd9baf483663346c8374c09b48c20bd1d2fdf7b5facb5b038023756637c0d7dd23f3

            • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

              Filesize

              671KB

              MD5

              d98e25af491f9f213934b33be80ef113

              SHA1

              1224fde919b9a4ff4bbe3a19485b4a0fc283b387

              SHA256

              2274be6099aa1ea1921c95b49ff1802ee28288357094ad858f2b9028dc199370

              SHA512

              5d3d6b7c2f92c1655b73fa7eda2c0406cef41330ce0c2d21b98ac25ba7778ce709a03ad85300fba0ed151fb89f875e3281129fd1a1f8aca77251b94aed357936

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.4MB

              MD5

              f29255833009dab19ca9bafde1eb6a39

              SHA1

              73f55b1d58072d016a24f5a071e6fd0a86767f0e

              SHA256

              e2bcfa9251e389f4dc1b1d54124e9470d231c96077eaab725ad4447de20dab1b

              SHA512

              4a0ba7e5b97a561a1acb66b90a87eab250ffba657b8c81b6ca5f5e29e56702913c753e175ea8b4fbde6664d8cd0333df6e027ee275a9d1556daab3512fcd80b6

            • C:\Windows\System32\SensorDataService.exe

              Filesize

              1.8MB

              MD5

              97861f0e58b1835822ab15a88e9aecf4

              SHA1

              dee0a89b211081fe4b83bcb386dfbd324d0e27a8

              SHA256

              072a9dbc24ec84381d5ea7b4634c0dee106843ac47254add6fb8d7c08918a077

              SHA512

              82f8558ee491e2f32ec6b3d0890b694b16ba5a28d4eeea07007e0e6de5ff2c1314f09d83b16bf6a296e964a0b201aa064003110021e765ffeeeb119f82d9de27

            • C:\Windows\System32\Spectrum.exe

              Filesize

              1.4MB

              MD5

              c59acca557acb578c35e1c8b98cd0627

              SHA1

              ce86fa52b0d23dd09f6708b9c33c5ce2957e2643

              SHA256

              beb3e329e26a0bdee99116e3ada2146b897a216009e2fbe3281a146f48cc714a

              SHA512

              af053cb2ee29af5e21f43bbe1d0a372d286760c0bd26854a2d1ff338dcdbcd2c4fe4879c116f1fb61237ef23a5903b7541dacd27ba8178652dd6da219467fbf1

            • C:\Windows\System32\TieringEngineService.exe

              Filesize

              885KB

              MD5

              e47f088d27a95ef17cf0da5b3ee5051a

              SHA1

              8d0f4ad21090f70f77fa0683ec8823e8c21d3359

              SHA256

              1e9482504b2458ab33c3ac3c442598ba8bc2fe189e00ab5b447df1f7ebf0efd1

              SHA512

              fa3fcc89803d4db6eceb358fcca0bbef40754616a1e41e0a6216697ce89960926779ef502f3921882b6b059db4d4f5f3ed355749ca4a0bcd87ecd7e60c09f7e2

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.0MB

              MD5

              c3ec01dd8caf63764b31c020cbe32962

              SHA1

              2418e125a9f5d230eda574cf112efe751a0e83b6

              SHA256

              265b3e1b2275c394fa27daeb8a3400ac9d28d521813962850d31172550c77c17

              SHA512

              6f0b29b55a2bfb7c683b312dbdbb8475ff74e413ed786dddb51ccf2f856e3555dbe77ae9241f255f045ae58b0bda0bb1e433b239d016df14160e81c5956bac2e

            • C:\Windows\System32\alg.exe

              Filesize

              661KB

              MD5

              0d0d33ca3afe4f70d29d7d2549649278

              SHA1

              cc4b5af4f35ec5d9ba4fe2eaf4d46748a9d5a4bf

              SHA256

              289283da802efccf9ce069b6a2f6eb66b32047b6c20f4e46a1741bde6e202196

              SHA512

              3f940f6b91a67c3131854696c78f46c1fe69a36ff97ccb8f0447f60f8aa9136b6968179b689ad6ea5b5b8d59f3a3f3f43946a589619b598d2dd8ae0debc6295c

            • C:\Windows\System32\msdtc.exe

              Filesize

              712KB

              MD5

              cbad434c18aea7da24251667c9ff8501

              SHA1

              46f26b0655200db638c51e5ec83c10116cf618d1

              SHA256

              ed82756eee0780764390375fdf7f2c5a4efde3d748853de151f6580acaddd893

              SHA512

              cd73bfe34fec67186de4272c0927ac162a0c04bc7574d33122b7d8de223b7cf281b34e2d1ff1f25b04c2245b2ac8ddf4e0bf7ced3b33b6c421b7776f190e4c90

            • C:\Windows\System32\snmptrap.exe

              Filesize

              584KB

              MD5

              1911bff4432cfe2fcfb7a4525e842a7a

              SHA1

              ed8d9a0bcc604fdcdeee0e2e21975bd926018a46

              SHA256

              caf60ad362f52733aa5a509684143726b20ac20242a265241dd31b7aacbf15d1

              SHA512

              2bdbe27f0a8c9662ee0b1298ab190721c2a3d9ab1ee88065e7dbd62a53245f96169d54a5ceead19abf48dc8ce6f07400f9e4c1b0aed27494f99642b63496bea9

            • C:\Windows\System32\vds.exe

              Filesize

              1.3MB

              MD5

              f0e27c092ed1c3a4bae5f238173217dc

              SHA1

              0606623e271d302390fe91f8ebc5e161e3548477

              SHA256

              d8cf0511154a73fbbd3a0ba8b886516fdd65890c267fbfbace27598c490219b8

              SHA512

              e3111e63de1b72c61d8724aad86853db5645516baa3c976c059ea1564cd64aa97310b76fd95bea4cbf061018b2ce968e4dba36b8bde722abacbdf6cb285fcd69

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              772KB

              MD5

              e9e22c98e4bb6ef1e3244ab675e779e7

              SHA1

              982b0abd777520a2fde1d2a3cf1f36d97539e61b

              SHA256

              81539b68aeb98d208a4e34c970e03bfc00014824981fd6be75e329f05676c1c3

              SHA512

              962927f49f24410f17a1ea982ca9247df2b814e34c22b284e466b1807a0879caad084231dad375a7243d2c8fb34f8ce4d7ee2edc90bbb4df03b1142e810423c1

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.1MB

              MD5

              231ca329f0def6d096048a1414f33139

              SHA1

              eb316c0fbf329a80b4daa71118cceaafa171b188

              SHA256

              e22841b33c0d8d8f8fb2a593da8ffbcb16fd8811c0cebc81f64ec84083a255d7

              SHA512

              f3f20d9f3f3fbe52e5d6a1334f53b9c1743cce87a77f60e73268dde13171cfd207eccd60e7d6873fd465efe69816f1bb24a753c3d5a1fa3f909e400581c7c8b4

            • C:\Windows\system32\AppVClient.exe

              Filesize

              1.3MB

              MD5

              05bea004a77d445aa0738dacdd236ba2

              SHA1

              812c49dc9a3e501b85f1ad5307f4dbdd8ae684f0

              SHA256

              4ff448e2cadc22897995b7966e2f57509516584a600ff363f99c544383f20c04

              SHA512

              9f4462670484e5deb82b4c6f9c2acb51a9f35352ec8947c888445d12a63c9b18dd4ddd39954f56bb3292b5ceb499625f9d07276aaf044a3313fc8f52aa60dff7

            • C:\Windows\system32\SgrmBroker.exe

              Filesize

              877KB

              MD5

              7e82b7aefc47e74b618ae1cd66868b02

              SHA1

              13cb7587e9f9fee6f8eb509b864621be6686d80a

              SHA256

              2562cc93486f1d7a095cc3b3e41759404bf4ee229180dcd57a46f812e068522b

              SHA512

              a16c1cf8cdaee7f3c9bc889a40cf2e05cfe345e593e4d3dcee65a607180c4827130a371f1e3c0ab3e2a362d45a947897421165ee06a0686404fc6a16240a1692

            • C:\Windows\system32\msiexec.exe

              Filesize

              635KB

              MD5

              84da1f345f0bc3925d3c3185071c37f0

              SHA1

              7fc8eb2eff42800a2ef2bb720176904e765e8eb0

              SHA256

              6adeff895539f2cf19a21fee611cddc6966c2f9c1b3c831a68283e1a0fa4a01a

              SHA512

              385ca48d467041d3fb8c180648d98943b6b7cc1e0b7662c8cd5835b0bc83694eadac6c4d904469807fa5c82433b5828ca5897f1feef7251c891ebacbf1ada023

            • memory/216-337-0x0000000140000000-0x0000000140096000-memory.dmp

              Filesize

              600KB

            • memory/216-117-0x0000000140000000-0x0000000140096000-memory.dmp

              Filesize

              600KB

            • memory/832-142-0x0000000140000000-0x0000000140102000-memory.dmp

              Filesize

              1.0MB

            • memory/832-482-0x0000000140000000-0x0000000140102000-memory.dmp

              Filesize

              1.0MB

            • memory/912-60-0x00000000016E0000-0x0000000001740000-memory.dmp

              Filesize

              384KB

            • memory/912-65-0x00000000016E0000-0x0000000001740000-memory.dmp

              Filesize

              384KB

            • memory/912-54-0x00000000016E0000-0x0000000001740000-memory.dmp

              Filesize

              384KB

            • memory/912-67-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/912-62-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/1040-146-0x0000000140000000-0x00000001400E2000-memory.dmp

              Filesize

              904KB

            • memory/1040-484-0x0000000140000000-0x00000001400E2000-memory.dmp

              Filesize

              904KB

            • memory/1116-164-0x0000000140000000-0x00000001400C6000-memory.dmp

              Filesize

              792KB

            • memory/1116-490-0x0000000140000000-0x00000001400C6000-memory.dmp

              Filesize

              792KB

            • memory/1292-11-0x0000000140000000-0x00000001400AA000-memory.dmp

              Filesize

              680KB

            • memory/1292-110-0x0000000140000000-0x00000001400AA000-memory.dmp

              Filesize

              680KB

            • memory/1720-129-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/1720-379-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/2320-69-0x0000000140000000-0x00000001400B9000-memory.dmp

              Filesize

              740KB

            • memory/2320-148-0x0000000140000000-0x00000001400B9000-memory.dmp

              Filesize

              740KB

            • memory/2416-168-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/2416-483-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/2416-114-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/2460-23-0x0000000140000000-0x00000001400A9000-memory.dmp

              Filesize

              676KB

            • memory/2460-24-0x0000000000690000-0x00000000006F0000-memory.dmp

              Filesize

              384KB

            • memory/2460-15-0x0000000000690000-0x00000000006F0000-memory.dmp

              Filesize

              384KB

            • memory/2872-49-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/2872-141-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/2872-51-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/2872-44-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/2956-40-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/2956-32-0x0000000000D80000-0x0000000000DE0000-memory.dmp

              Filesize

              384KB

            • memory/2956-128-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/2956-38-0x0000000000D80000-0x0000000000DE0000-memory.dmp

              Filesize

              384KB

            • memory/3064-31-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/3064-28-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/3280-1-0x0000000002340000-0x00000000023A7000-memory.dmp

              Filesize

              412KB

            • memory/3280-0-0x0000000000400000-0x00000000005D9000-memory.dmp

              Filesize

              1.8MB

            • memory/3280-6-0x0000000002340000-0x00000000023A7000-memory.dmp

              Filesize

              412KB

            • memory/3280-87-0x0000000000400000-0x00000000005D9000-memory.dmp

              Filesize

              1.8MB

            • memory/3476-156-0x0000000140000000-0x00000001400AB000-memory.dmp

              Filesize

              684KB

            • memory/3476-88-0x0000000140000000-0x00000001400AB000-memory.dmp

              Filesize

              684KB

            • memory/3476-89-0x0000000000BB0000-0x0000000000C10000-memory.dmp

              Filesize

              384KB

            • memory/3476-95-0x0000000000BB0000-0x0000000000C10000-memory.dmp

              Filesize

              384KB

            • memory/3836-486-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/3836-157-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4152-111-0x0000000140000000-0x0000000140095000-memory.dmp

              Filesize

              596KB

            • memory/4268-99-0x0000000000400000-0x0000000000497000-memory.dmp

              Filesize

              604KB

            • memory/4268-160-0x0000000000400000-0x0000000000497000-memory.dmp

              Filesize

              604KB

            • memory/4268-100-0x0000000000520000-0x0000000000587000-memory.dmp

              Filesize

              412KB

            • memory/4268-105-0x0000000000520000-0x0000000000587000-memory.dmp

              Filesize

              412KB

            • memory/4320-79-0x0000000000500000-0x0000000000560000-memory.dmp

              Filesize

              384KB

            • memory/4320-152-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/4320-73-0x0000000000500000-0x0000000000560000-memory.dmp

              Filesize

              384KB

            • memory/4320-82-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/4520-485-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/4520-153-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/4772-491-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/4772-169-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/4876-149-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/5072-489-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB

            • memory/5072-161-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB