Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 17:50

General

  • Target

    2024-06-11_44ae50a879669b19fa40bf1cbf6ecb36_bkransomware.exe

  • Size

    712KB

  • MD5

    44ae50a879669b19fa40bf1cbf6ecb36

  • SHA1

    560ff3d58e284480829d67699d333a78c33ea26e

  • SHA256

    6496464ba57ac74acd38c10372829a00c9b93873921825ad5e2477e360f75ef7

  • SHA512

    6e31d08015383282d0eabf60dcaa20ef28e9a42742403a5d81ce3dbeb14b1a418f5d2468c62874e87e370c846deeec27264a77a302d90b2f1624294c18dd25f8

  • SSDEEP

    12288:4tOw6BaAKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNU:G6BbRVldlnXfH9gPwCn7vOb7HHcp/CGS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_44ae50a879669b19fa40bf1cbf6ecb36_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_44ae50a879669b19fa40bf1cbf6ecb36_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2584
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:64
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3980
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2948
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4732
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4160
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:752
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2612
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3816
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4524
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3048
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3584
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1264
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1692
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4468
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4764
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3420
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2172
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1384
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1248
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1624
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4776
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1900
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2156
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
          2⤵
          • Modifies data under HKEY_USERS
          PID:4004

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

              Filesize

              2.1MB

              MD5

              640a56bd7df53f1c30faf42d1068372c

              SHA1

              581951a84ad061f7b6620e46a3d4ee73d1dc2a94

              SHA256

              d6980977cd6c576867e73e9c98d81928df3e2cad5d246a833f750113603001b7

              SHA512

              1bd3a0c69bbf873e79f2b4781a687732addf0dbbcb8092e891d8e85b96f5e750523f57c6964e77a6357e715e77063f7af2a6b5653288b05dfdb208e658b5dc6e

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              797KB

              MD5

              c367bc5e2d6eb5739a269526d994513b

              SHA1

              f42cad5969bf1f750685f07db2728807286a7849

              SHA256

              ab9b5ff05feae822908d2df975e9d13137806de46c635f9b621a35eccb59e030

              SHA512

              93f309116da68637d0209190dcc3faa16f0f289bf50bda49958403bd597f61dff7259cb2844837b0d5b16ee1bd7685e75e70a248436f195646eaabd7e7815663

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              1.1MB

              MD5

              3d9248d88d12cd564d3968393914891b

              SHA1

              def85dcb2a3640f251568caa8d1783f9c82b68be

              SHA256

              8a085458a5395f05970e0f3ef0afbcba06cf1440ad22cab305217be1c8e0ef98

              SHA512

              7d262cca4af34ff9f76b8e1411a8c6bdb66e1d427f4052a52b57face2d947bb826de067080425daa2b2c7fe94cada6f6f66e478021e7ff62f408b1551b73d4bb

            • C:\Program Files\7-Zip\7zFM.exe

              Filesize

              1.5MB

              MD5

              ad1a193127cf74776d6a2812226df349

              SHA1

              eadcf5fffb410ef6aaafd29473b66e61459a0c03

              SHA256

              9e8db5c900e1ab218154e5e6b800351ef5bac3696546f234f479ce766fce21a6

              SHA512

              a4925f4ebae33f59781c05151f9209f14ce4f1ee08acc2c0dcc611815f8a5cda614be25881552b8e23fe80a8421847ae2e8324068b76e2e81fd129019328290a

            • C:\Program Files\7-Zip\7zG.exe

              Filesize

              1.2MB

              MD5

              d34c6dfb80e9d75ae629020b0b34074d

              SHA1

              d3b5b104a3f80f2dba4829bd68ccecb10ca159c6

              SHA256

              5172f97514f5d4998a2778e98bed0fdce1c74641d1495b3adc7500cc56d6fa57

              SHA512

              42e2b980da1ce4300c12b1794ed1ad19e120e94dd5a60ac2c610ec1876da67a68859fe2ffea7a8da871a6ece12a65cc01aeb9d6681d4ae3c816651dcc406af61

            • C:\Program Files\7-Zip\Uninstall.exe

              Filesize

              582KB

              MD5

              4e0f38a30d183b9fea1090c21f641e00

              SHA1

              52d9111f2b7672e4343467a8e990ec9c13957545

              SHA256

              11b55cd3ed9f3433a9adf48060a8eb562d059de11af923ca39307766d11f2762

              SHA512

              e6385e6c3b5573d46e317e610dee760735d7057daa1480dc915cc57e9bb3d5a365e083dde6d2055afa8a60e6879c41b6f1a1a0811080fefd74e21751569c2299

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

              Filesize

              840KB

              MD5

              2700379104708932315a118e3bfe27c6

              SHA1

              56d1eae7da72a9626568fccc32bba2df4fc97802

              SHA256

              5736e8f37f10acf12fe9f86c0af858fc57a600a12e1a42f823ef93aa198df926

              SHA512

              f7b77513cd94d49a7674e3103b276eaa31556e58079d6a43282ac88828cebf02f98e2650dcf479a928d2802c1f5da0b1021d2b2f2279275c29d3e7e2030eb08c

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

              Filesize

              4.6MB

              MD5

              4a51ad30e4d1eaf65b35c600ccd706a4

              SHA1

              542deffa08aa50c1bede8707223322430465a21e

              SHA256

              885552fae647bc5fc9457b417a22993f67d959d1bb99340140c70755156fdc9d

              SHA512

              9371844f0086b136a784978c172392e87bf35bd4f715ded4150c1398b52eccee2d1914ad95baa0c6709c4bc28cd029cc4170d6d80a85d9b7ec15abbbec8af545

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

              Filesize

              910KB

              MD5

              d5ded4589265e20983daf16a74fca149

              SHA1

              6fa6a5679ca4b707636fdb6e93f0bba76d2d3f8f

              SHA256

              6e5167f46f4faa120e2025899765bb9895382f603d687a221171c7cee42b946d

              SHA512

              f6112ee17e8a024452f7914379f4f8d0219cc1658897db762866fecd4683772135d59771aa6e5cc85b4332a81f3c1137ba20fcc20fc1ff0d3c10d409665a02b9

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

              Filesize

              24.0MB

              MD5

              2c24b7bb68f922ba6602a0ee2bb8b503

              SHA1

              8ff49ce377daf939824b01efc4d19d0476d3c67f

              SHA256

              52d7708b7c67c3f44f3ec41252b5ea0dacdddd7f6b82be90b467ef7ae11db531

              SHA512

              f87b5e066a91b9c2e3036fdb934ecdbaa993dc61561a60dd9bb2af081d77f30a6784aa4bb7b1861da12dd019294505e4f040c5b7b20354e5d1663225614c5915

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

              Filesize

              2.7MB

              MD5

              f0268faaf24d70d61abccc7e9ed4b07c

              SHA1

              80bff6618d314540cfeed3d7a16f07cbedf19f63

              SHA256

              1c0f1c353610dffbcdf0a6d258644944a054788d20c6fff21b43fd9994e9f5df

              SHA512

              58473f6bfec285a24debec1da1d186e689ea807b9e4ce389e80b8ca5185592cd4e94fcf01441115f6b08b5eaad4dfb1fa81128435b507c578fccb7fd603df852

            • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

              Filesize

              1.1MB

              MD5

              7a46bfd103b007ec42270b12e32b109d

              SHA1

              fae7aa2e5302630e5b88e2673bb67b28ca459c69

              SHA256

              54a66c57420cb3e1b34c55d8ebcb9da3892da1b6d3254e310c6abedcd234c082

              SHA512

              ddcdcb0b505b225eed09c854387540833fbe25931f4c2a530b60ca61b14cc14fa2f622b7717eb83c859aa44a1620694d8f9564027dceccd5d1d0cd627d6dc72a

            • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              805KB

              MD5

              b20138be70a780914b19727c9c91facb

              SHA1

              2fc67c68d9d26a9779e0750ce5d7717f24d94b68

              SHA256

              9356ac3cec19822490e76e5b15a9b7fc18d2b30ffe6958ae11f9ab4b36610ff7

              SHA512

              caa3e41f618b3c7a26f424e0cfe3bc5df2ff32b225090956a4bf85f88cbc682ab573ce5b43326f6053889731528c62fd6533166774a12b4b77196e4eb8cdc211

            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

              Filesize

              656KB

              MD5

              d895dad0989c9297e9354319a15ca6b7

              SHA1

              edb8dd48ffe2cd03dc45a0c9dc9cd4cebbd671ac

              SHA256

              7ec483ca5fc2887d9ae0496f5c8cb3755e095ec43521f3e01d9ace5820b292fb

              SHA512

              562e2fb9a495ec3a774c6085605b24a310feccfeea2206e3db1edb46f13dea9f9a5425f53f6181b8fc5f6d5c279f3f2fa2ff40f96ea11f6f9aa5bbc7e754ad9d

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

              Filesize

              5.4MB

              MD5

              95ea94553b1bed203f70e50a4eaf2d9a

              SHA1

              52ddada5c327466757f9ba6082776b5d2929bbda

              SHA256

              980dad3c1ee1cca959959bf1d807f9ab614427cb6100583b50dc7e580ab34f89

              SHA512

              1c92a30ef0c50085bee6fbce6bd0335107370cdeff4f4aca4c3b9bb9732ddfb84eb5641a781ab30b95596fe4d3321e23f81967d4f89be00d21f3c09c7e970f10

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

              Filesize

              5.4MB

              MD5

              46dca510d7e2e84805cfc2096ed5176d

              SHA1

              e0d5a8d1a98ddfe3927db506229f86f3fab6d578

              SHA256

              081bee43c0fa04f022f1587ea5b280ff84e61f3e92564b5fc6d0c7136b8ff696

              SHA512

              44e29ebee822d0cfcb1b0653d780223c2bf9ff12784798b339c90f1e7632fdffff1c9ec29c61c3da0a7590724b1a166913a24b96e58348481ae081992ea516d3

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

              Filesize

              2.0MB

              MD5

              5c483ffd7caacf4f8c89309d5e7370f8

              SHA1

              cbc18c2a6452b84f641d81e44b0744ab9e6c4202

              SHA256

              2ee6e40127271fc92213a6459240a6cb5f062c40232ba98077803c74c1bcbce6

              SHA512

              4a9acde85d28128994d321c436319779fbff601c7c7a9f1c0f46166f05e7919a576701f5cf3be7ce85d9b51e1645e720babdc89870c946280b5a7e2e3c86fbd9

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

              Filesize

              2.2MB

              MD5

              7ac23a2c9e05b4ce36e1990a443947ae

              SHA1

              e7b6880b29379b1347c2c4f4c2fdbf557cf74271

              SHA256

              b4e256082cc3809c56c0cb84ea04a0a6dcb059054d4e8c155af839d100450435

              SHA512

              f1ed20b7858d2ef7c3e770eb796066c30758c4839310c74932cf1970c4b148949dfc0a7b6a05966067ce9e9df9648e00303db46e84e0ca91f82e251ffd1dbedf

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

              Filesize

              1.8MB

              MD5

              8017bdbb71147470b195c27d629cd188

              SHA1

              43586bf475726b7798e378ef32d5dbb37fdbda6d

              SHA256

              f5e241746b97d0dd929279ce1f16ddaf917c81c1df3a55d006c3b1f12567beb5

              SHA512

              7143f2d22bc93bc1647d329107b2df8ece3921449259cdcee0d322bd60709a7c012a33b3e987ff9c56d911567ad686a9e6e7e0fcdc527f428b71361dd1a983da

            • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

              Filesize

              1.7MB

              MD5

              78b11107236aab6569b354e6e40cdc3d

              SHA1

              b0bddbf3102198e1a040b208dfda693d9e631a32

              SHA256

              49c1dcc6358a1db430b9e35d1d2980c9f3e818e481eb2ea6ad6e52bd792c1aa1

              SHA512

              56e6c9386e6ae837e4898ca7a0efece75234da4ab52911ca8b7f78bea6263fff8b80842bad835d4b20724d18218158938a5bf2c5cae3b554c6d09bd3f119725c

            • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

              Filesize

              581KB

              MD5

              3fac5de5edbf96ed3bf62192b8d1d72a

              SHA1

              510ddf643e0ee40ff3ce7a70448de7877cf7d80b

              SHA256

              7f381c88d94b57bcde55b8828b81a2830aab13ac95baab1a53125f6acb52d5cf

              SHA512

              7ecc492c201e4c1978df928e5034cd698eec9a95abcfb8b161f4efee21651a23ed9b76fb9058a246633af3b1f4b719c205c6c6d3c7fc65c4b62cd62e5b88feac

            • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

              Filesize

              581KB

              MD5

              f88b8e3e58f954362d181e6c38e1292c

              SHA1

              2e8ee5eb4848f6707f065790f97d93f42b49190d

              SHA256

              3ad9e05b8230f6399f1e910dece226b204b697e851e866bd2202539cedc60e02

              SHA512

              dc86c686890487bda48ec15358161d2d12cc9a3ba114745b0118039c906a38607e50addeb3ab2c42e8934aa365d82750f7cbd0c41fe359ecbc6fb3347dd8caca

            • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

              Filesize

              581KB

              MD5

              8ccde54f3d0839f3fea14b7f6ebce86a

              SHA1

              700bafae280aacffde75859a762d8366e18078ba

              SHA256

              8d4c36e272b1b220ef6cb598005b86e1c6013a449a2b6acf6c9f1fad5738688b

              SHA512

              bbdf699e497c21e8ec577e2a73f6b9173ba17b0a815034765ea6710380852117d66df9a834dd5667401a1251e2ddf84cb413e53b3851858b4e8d4d198bd15ca3

            • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

              Filesize

              601KB

              MD5

              ff433601305e28fd1b6f46cb1a18a1bd

              SHA1

              bcf757f5e595c8ae6bbbd4a4a984055a76be915b

              SHA256

              06bf4aa8169dd9a70496c1dd7353857877b6778d54fdb295c91f61178760a4e9

              SHA512

              f4e09a4285a2d0d9cef272db80319f4d0f9c7d28ae997d7db707eb9712d91439ecdf652bf06147b0d48718bdc3d78e819f17eb11c00d71a68cb284828b4a98ed

            • C:\Program Files\Java\jdk-1.8\bin\jar.exe

              Filesize

              581KB

              MD5

              0221e31996f25f7e2391aae1d5e98501

              SHA1

              e7f98b84f785e35091fecd1d1594423d18692621

              SHA256

              e83ef10b254af97ad2087aac082e284a74dd22662cbc234893a470c3675e57ab

              SHA512

              bb07fa2f67db14146548ae15c10a95d41d38a3af9e2d43fba04694849fe0293f7dee1d57939da6c503370c6a0faac98ef3880de2ba6763ff1b15f3a85e0d1f35

            • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

              Filesize

              581KB

              MD5

              e1a7c648b1a550a6b2f07e62cc801fb1

              SHA1

              4a4f45d704f9c9abfa848b44090fc8d34da631fa

              SHA256

              9c9fc1302e7dcd7b027043d847cbd43f863e4026d9b3dce8dfef48dc2deb0aea

              SHA512

              b9523f0e61fcc008e5ca9218d9d9ce8ff89f91764b885d884c5eca6531675238eb734d91ff8d1b4d297f6b412d40b49ac72dafadcb74206eabc4bd0673ab57e0

            • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

              Filesize

              581KB

              MD5

              ad37e6c9ec0794d97c2a0dd672bab3fb

              SHA1

              2d1c1c889d737352cbf97c7bdaa38d35f617f59a

              SHA256

              5c56a07164d44886e928163a83dd6134ea667b6d41192f41141e2bdb15edb401

              SHA512

              4e1c4d17041aaff302bf23c63ab7c369eee813b9d23937c339da750cb83b912deb424b70fd89fe7cea7b6afa0f5f7915b72aa8bd29fa4895902dd159161a7cf1

            • C:\Program Files\Java\jdk-1.8\bin\java.exe

              Filesize

              841KB

              MD5

              2c379be8e1132ecc0db4ca21b9a53b13

              SHA1

              a49e29d432ffe8b45ca85ef9f231cd6dbb0f846e

              SHA256

              071a349b2142a7133106df67a8753abe2a75d280d3bf736605659cad82c0f210

              SHA512

              feba4a0a9da7434f4e7a0d39446c120ee116340483cd9582feca604a12ab5ec500d48982a78ad004578716abd684af65a988df928316b0e106e2cc862e9d5328

            • C:\Program Files\Java\jdk-1.8\bin\javac.exe

              Filesize

              581KB

              MD5

              65e755e32860c1e7199a9159e343a8d9

              SHA1

              7eeb12ce1e21288ef5229bb3d460ba055d97b156

              SHA256

              70771e171185a15639883cd91c8ef3a94d7461a40913b6cc5798ba05d1582b27

              SHA512

              19344ab235ef260ba85038a547255ab3be3729e1d3144c6eb2425118aa1b1cce37da7457f759d607024d23a7a7629a4fb4e1f6acc36ba4af2227b551fb280c3f

            • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

              Filesize

              581KB

              MD5

              d05560661e6db69109311771b73a0174

              SHA1

              fbfa44a5e006d3408e2626e087a9be479543f0a2

              SHA256

              52fc75b253b0f4f7dbf335245f38a61888a0bc20056d7a6d50ea273c1d00bad9

              SHA512

              65fe93363190903a0d45164b6c92080c1d87a44711acc98e9c94eb5d35ff2439c336ed6da163878f8a346040c344c8b17396ff508afe62a9e7810e6023ab8b79

            • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

              Filesize

              717KB

              MD5

              64f50b833dd50f4cb6bcce8ef4a9f141

              SHA1

              7b4e293658553ba5d0978853faf5301169821d5b

              SHA256

              ba5d12956bfc30c13b9832d3e21e9cb2013b0363a8811228a314c4cc692abae2

              SHA512

              448817dd1f1fea09a80e603dd21e2528f025832ea5207cc82ff60ca3df57de22012cf94ce35b9249f58387428923744ba927a305de23d79a4dd95bb6979700a6

            • C:\Program Files\Java\jdk-1.8\bin\javah.exe

              Filesize

              581KB

              MD5

              0b145f341a242e570228bb384e79be34

              SHA1

              4dfa07d99e2b58f5b13bf59098364d6b2ae2a524

              SHA256

              3733bcd421fdf191e7e5cfe7004437ac5de178a1c2e3ba20bc1b62ee2630ce04

              SHA512

              afa29924cc1480c318c5b1b0451ce8dde9735944819c6130f5dd90eb47b5704f9e07ad0d67d395f1374425096d3a6e38c59a5cdb55fd7dec5bf450aa7063c67d

            • C:\Program Files\Java\jdk-1.8\bin\javap.exe

              Filesize

              581KB

              MD5

              cc27935e2dd5b46b2ebdf4ef477d283d

              SHA1

              96d0e8e090c9b31fc70d3b1422cbaeea2855b79a

              SHA256

              8e3abb5898b79fc1f6418fac132ae492e1f6670e90206751764ab6aba426c0a3

              SHA512

              a4f530118710fe78f98b1ea225d2cc1b4d73c094344a2b7471df99a68766275f54bdb01ceb3b2e59549213e523619439514b97eff2a5d489ecde11a53730b16e

            • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

              Filesize

              717KB

              MD5

              035e5c762e0894901849b8bd8c981f8d

              SHA1

              704070b97b9000bdffcbdcba5e3c4dbec1de08f4

              SHA256

              395a409be800e34140d8b75c0d3d1f26f426169d532edb685f53e19b34eb4b31

              SHA512

              6dd8129564122452fda890ecc13b844d94f421f13fcbdc65d87e5456ee0805a3185b331b4d0c27349fdcd6c64727da13712b52949a731b4f31191920760213ad

            • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

              Filesize

              841KB

              MD5

              f997313a85776f2de9ff16e7906bde99

              SHA1

              f161e95c9d4ef9c439e4a662ca2df31029322599

              SHA256

              b75abe66244579226e3d96257bf82c7af80a212e7abc0e4ddf938cfe69e6614b

              SHA512

              8da04e2a0cdc2c0f4ca99e75ef16a08c6b1876c0f5b25e7d37e04b43bdce3958f032cb79fa2d8c6fda4dcf03701348b1d6eaba61d4a91c6331dcc9c922bd89da

            • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

              Filesize

              1020KB

              MD5

              e71067db2c0dc75e5f676378efa74926

              SHA1

              0575ee9d05300596f9f685b94337799c58a5d3e4

              SHA256

              8125d2b7553b18af735b019278a7e97a7ab84fc76c1c0cbd0f251a3a27b5a905

              SHA512

              3f30152bfd3025136ce394439c3f8203661ca4210f3b9b4ff7b0194ec11e64d310f3bbf5838b02842438c09a9c997c342f77b6862f75102fbd9c5f83fb07ab65

            • C:\Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              1.5MB

              MD5

              7d54404197914a06705ac0331bd9f8fc

              SHA1

              a62ec9a6b98c271635d067a6e4aeb4b275005a33

              SHA256

              9686801ff97f8e9dd18f6afb662e78b81dc8c635572a47552e3a24e8e97b8c3a

              SHA512

              55800e3b3173a12da7f4d589c33f94b11102b9d16dc333f0a7b8d521d4c5a4150d45ba829c15fca273839dd71a7443f0b8139a88a789cfe8a850d992271e3b2e

            • C:\Program Files\dotnet\dotnet.exe

              Filesize

              701KB

              MD5

              c1db790f0d83e1fe82deff2d6af437e0

              SHA1

              511a2023bbfd744073dd026b6c7adbeb2ed6e120

              SHA256

              0359d0ec25cfa6fe43d9ccb1f6954ec2eb8b16762e2cffb9b67cb0398abbb86f

              SHA512

              670a36e7cc94f65d3c4143ea9ce6cc5ea98c4757ddd2e9ba52c569069bc4fe0152f7371dda4d30de7956342676db75b022d7cd32cfc4dfb2b312d2007a2a34f3

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              588KB

              MD5

              acb3e5d5dd6cc7912adc4f2c1aaf4e9d

              SHA1

              580b3d8fba3b6666d7db3b264200d493966a95bb

              SHA256

              aaf41718d38e354a7f8a3e80f3c1f0c92f38a41b925efb6547e1469c17ca1af8

              SHA512

              56134b6380a9d1255d1633211773b838ea2097393d1f3a337063c05019ba52c6f81c517c72bf03e7c2a9cc85bd6808559a6aa81bc01492ef601047c05e680c97

            • C:\Windows\System32\AgentService.exe

              Filesize

              1.7MB

              MD5

              607b8516d004139bbc4a021f4c9af2e5

              SHA1

              6260974966539ff5bbe5ea5063fce925295e62a1

              SHA256

              168c0932aa5c995aa798be237571ac811d8b0e83e9a2fae4e5a615572ea617ea

              SHA512

              76a634b4aba5533ed775b108e1ab92269853a492f6bb1940bac4dc7e337be3ffef81007fa6813998c1c4ee1c58fbd0b44a3252979d410f9ff5c23eec0a619859

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

              Filesize

              659KB

              MD5

              dfbcfc1cb6b41b76cb75fc6de5fa15b2

              SHA1

              9b6417474711b3a8b777904aadd33cf5d0068d9c

              SHA256

              fba33ea266f0c21362f180a23db268b528be7a5d9a9de04578e74c2c09c5fcba

              SHA512

              f3a540d37f31969d07adb59aefa80fe0172cda72f10d14c760f6e68cc327876c15df2c3eef31eaf0d52b5328dc5eafa2030c6fc2ecdfd0cab0ee43e6579b9a7b

            • C:\Windows\System32\FXSSVC.exe

              Filesize

              1.2MB

              MD5

              209ab870fff8bf107c659d3c6e4bb333

              SHA1

              2b23527099f4e9be3982a721fe5728c4d63e69d0

              SHA256

              49d43033b4b7999d140b7178d6f0dee777afa881a20e265ed88fc393c3c7ff70

              SHA512

              7c3b7d00e9eaedfc29c3dc632d8eca871c057721782ef715b2ba2a8560be5d15af1a69f1d7513f42eb71f19097e702f8bab7ab1551ff5447f6b38932c5ec0385

            • C:\Windows\System32\Locator.exe

              Filesize

              578KB

              MD5

              0fa0b9a57e0d79cb981553d9fcd8486b

              SHA1

              1833a1546b0c9c57d05304e1451124f407b4ccaa

              SHA256

              700cd8d6db7f667a88d67eb3934b198abcef4596563b6cdbcdbbee695ca999a5

              SHA512

              851cc8a1174b923176bd8d660de35540d49231153a126ce35e4fa4aa703be25e0c10f0e66f6796b5a82bf19981918b11a6d79d587f146a7cf6aa9b397cd064bf

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              940KB

              MD5

              6a2c71bea7c0a1ec965e11402ec8da34

              SHA1

              c7808f38ce9d9a4e9038308d3d1574100dcc3f6c

              SHA256

              d517b3854ed943cc741341498977b2bb7791c7c8e77f7af27cc80a0e7de2e133

              SHA512

              d7a6dbcc2a60e22d247485264420f2101faaaf37f2ecfb28e1490933be9c3b441a0a8935665faac172681b1342ba9edd28d8ae11a02f49da5849fd51a55128f3

            • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

              Filesize

              671KB

              MD5

              09a8ba5b62ff95b5e53cdbaf8081330c

              SHA1

              c811a7d32f8c8dc15fb0310e7bc4d322a3fc4f6c

              SHA256

              11ee72d09df7f6ca28f65a5dc74446b4c3f7cbb1d6d8efa5815a002faa6d386e

              SHA512

              6d258ce39ec81cde91c5705455b979f1cde6f165ccb5b6692d2b296429bde963d6508b677e0e052e6b236fe07cdbda4fd0eb8352e1a9a7b4cb6fa61ec70ddb66

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.4MB

              MD5

              439ec9ed8efd4a07ad210c7a04b65c0c

              SHA1

              9ce80d901012f7d2df811dc7f5dec230ead3f9e3

              SHA256

              8881b51e19153f99032592aa9b77746ca8933bd23b4b880c9043c7d2b9395382

              SHA512

              2f2c49dc8b06fc9d118ce719dd9e7f2b29f11cfe54f297cc74110bfdd9e06d89dc13e7854f5f85dae0e108d0293ed882c9b56deab541014cd93877386614d4da

            • C:\Windows\System32\SensorDataService.exe

              Filesize

              1.8MB

              MD5

              6335d7c181fc7c3296e32a105b745f92

              SHA1

              28fd4ba8cf24fe605084bd71dc0768ac6c4a7ceb

              SHA256

              eef69e2265f2b36e7cc3899de8a6485f1fff09b98f7ba654b2308537f13d1922

              SHA512

              634cc636b16eda1d39ebc62aa4c13c83410c60860433c7d51bfe6d6885dc8301342d69d7d61e035f1fe414e03b8fd6ba9c3e9c24f8ff6c4474291178fdaffac0

            • C:\Windows\System32\Spectrum.exe

              Filesize

              1.4MB

              MD5

              f90c139e965fb06176f589d35a9a7589

              SHA1

              8e02cff3a020685c1e13a24e148b843213db0f81

              SHA256

              42444e1a8640280958f4587abd48e9083e782fee956c8cdf955f8954005b303c

              SHA512

              84f1fe8d853c00cc0c15b551df6c3512a7462b646d69fced072eda6cad83d8ef3f4bb9b9c755f5d73aa695b4fd910a3a8de9b388fb213003f40741617dce54cc

            • C:\Windows\System32\TieringEngineService.exe

              Filesize

              885KB

              MD5

              71518ae7e3c1a63ae424f5f72da00723

              SHA1

              a0aebbcb6c53aaf690106f0bd8b67567a5126fd8

              SHA256

              9cf65c7d68f95dd0eeed8aabc95638d4365b2ced5fb10acd774c3ae810d4d929

              SHA512

              d4fb864d1ad2cb33784b4b1a414bb1fa76f283f178026fc9103b73cdeacf700d5af9bd3bf5e49e0cc784734cbf23552e8c51eb9724c6a086c9305d5f86a9b2ff

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.0MB

              MD5

              379fd44500a795ceb579a5be39ddcc6b

              SHA1

              af1961bc0a6d81b38c4e53421f739f727dc05382

              SHA256

              220f72bae53ad2cb69f8816b94d28e945e728038a3ad5b2f40762d246ad3dd5d

              SHA512

              b196104908df87ae9f073ceccdf43f531e5b665d95f5bd0be209590876de7ee1456dbc8a3966c211e261f34ba0d6429003e3f82d6eb94fdc908590b65aff357b

            • C:\Windows\System32\alg.exe

              Filesize

              661KB

              MD5

              0c706c7c4be8a68a4600907b60e4fa07

              SHA1

              a51aea9afb52679c3830b1ed09e6788859aae7f8

              SHA256

              551faa1152d5db02b55d49349b58a27f48504902bac94fa6fc1cd013e537e68b

              SHA512

              a566a995d1e9ef982f0ba8c796200b5b96ae0ec5e304955ef4714d731c8912455f690ecfb7f11c01da98fa34387a3c523e55fa5bb9284a19b2e5de580c5f4551

            • C:\Windows\System32\msdtc.exe

              Filesize

              712KB

              MD5

              829af5cafb3b5ffa786ee5bd54ad12bd

              SHA1

              8936236e91943754a027ca15cdd96d54f16a9d4e

              SHA256

              d6573e8ad7cf5286e3a8705633783e4dc2bc8646356c4b3164b06b8a18b09205

              SHA512

              896a3bb458baf68b4fea2328312300179c5476f002447f510c12ced822f794c81ccddf9e600d83f23316fb1f0022bf22e32691ff60efef29bdf91fdf6b5c51d9

            • C:\Windows\System32\snmptrap.exe

              Filesize

              584KB

              MD5

              1ecb4dacf4c55577d7fd284d63df3fc4

              SHA1

              017d465eb7a9c4d11495d4fbfb6214de9114dcf9

              SHA256

              8f6bf3ed8e95529ccd400a9fef031fe4e5b1f88824e7628bad510855fe964651

              SHA512

              36fc09d4bf9b646b2d02641230672ecb0c740cb3806269d312746d9b2bdf72fab2b9b8c4b0722c636a29bb66aea64fc195e728095ad3e8d5093f402ff5472d82

            • C:\Windows\System32\vds.exe

              Filesize

              1.3MB

              MD5

              9d288fb3c581f2c42b9b217e13159d96

              SHA1

              e8c51731775aa8b5b97c2f8412c3d7aca92c77eb

              SHA256

              2edf8d454195f6f87aeddf45047169e9bf388923921c944c14ac6f010a46d127

              SHA512

              2e2fa27ee1da55acea92d8655d8a9306cfb79063bae75683cc0cff71cfbf0872543f8debe008f7092f8cea93e31af5bfa6690db627ecdfac498de125500d15c8

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              772KB

              MD5

              a19b453f3f2a92a9d63fa74cd2662325

              SHA1

              8d13720b136106b4a178097a2454e7884c2c66b4

              SHA256

              e54b860bc42e91aab7c669126f002d39680543d4ae7b948623f4a499a34b1610

              SHA512

              ccf96fce6a827e0e0ce35905f3a4cfa9f2898a01993ea14e53a9a888fbfd5cdfbf5c103a6dc425b75334b4376d726bb875ad9004018271304ab68e23ce54afd7

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.1MB

              MD5

              b1500703c73b6815b9ee9aafdfd4e8d1

              SHA1

              c8128c7ad94c458a4aa76af2ced6a2063bc1f6bd

              SHA256

              5b9820b6504db540f809d79525f951db96b9a30c58bb8c78879dba080f7eb3f2

              SHA512

              65d1b6e8fedaa45d2e2c28c54ddcd2680a9eb0256227d104c4ef3c5c836437584f5a588b696529a1d89966feb516b861947864ece07e2f2e5e3bf2df6b5b06af

            • C:\Windows\system32\AppVClient.exe

              Filesize

              1.3MB

              MD5

              969fbe10d16807cba3b44f7700971a19

              SHA1

              58c4d918b3edd70a5fda5e978656575c93a27902

              SHA256

              4c3e9843e800dd3957e61555c7c0ec641cfc87a83f3b9aba9ccbe5a1d2958c66

              SHA512

              bd707c2f83da7ca72ef07bcedf666923c058dc7b600a48e5ce18396de796680390046a175ab60349d3ad5329188d25855452b427a8825304a9f678f863c8f256

            • C:\Windows\system32\SgrmBroker.exe

              Filesize

              877KB

              MD5

              2c026bd5bcd8c7751a71659f60023f2d

              SHA1

              83e483c5ef7e74f325621c07b3511813dd952eec

              SHA256

              9438fb856fdf52cbaaa089763110538bcd7713e87c7af70a57beb62704803f80

              SHA512

              edde1e118dbf13b0d06b8f512cd57f10f85dbb7f124afaeb2696791b74c32f6434d365c8a7ec3a37a9e03124946740cd6f025ef9e5df10720f07b95c0f15a3f1

            • C:\Windows\system32\msiexec.exe

              Filesize

              635KB

              MD5

              896d250bfa35ac2cb209fac3a2d28911

              SHA1

              32acab6287efc0bb04aee1d3dfeb07def0c3c740

              SHA256

              d57b3893148d28dc3e8ac16603118246cb20ae17c8a42aa75b82325aa0110d06

              SHA512

              7c763b27917a006cc192be1a7253583c09f0851d51b4aa5c8214d254ea15bffd22d7b73b12037c01208451c9b5d721ae5bd926bfb5161084f7df3a494867757c

            • memory/64-21-0x0000000000710000-0x0000000000770000-memory.dmp

              Filesize

              384KB

            • memory/64-12-0x0000000000710000-0x0000000000770000-memory.dmp

              Filesize

              384KB

            • memory/64-20-0x0000000140000000-0x00000001400AA000-memory.dmp

              Filesize

              680KB

            • memory/64-117-0x0000000140000000-0x00000001400AA000-memory.dmp

              Filesize

              680KB

            • memory/752-67-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/752-70-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/752-61-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/752-186-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/1248-224-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/1248-597-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/1264-139-0x0000000140000000-0x0000000140095000-memory.dmp

              Filesize

              596KB

            • memory/1264-267-0x0000000140000000-0x0000000140095000-memory.dmp

              Filesize

              596KB

            • memory/1384-222-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/1384-217-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/1624-236-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/1624-598-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/1692-272-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/1692-595-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/1692-150-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/1900-269-0x0000000140000000-0x00000001400C6000-memory.dmp

              Filesize

              792KB

            • memory/1900-602-0x0000000140000000-0x00000001400C6000-memory.dmp

              Filesize

              792KB

            • memory/2584-2-0x0000000000970000-0x00000000009D7000-memory.dmp

              Filesize

              412KB

            • memory/2584-8-0x0000000000970000-0x00000000009D7000-memory.dmp

              Filesize

              412KB

            • memory/2584-102-0x0000000000400000-0x0000000000584000-memory.dmp

              Filesize

              1.5MB

            • memory/2584-0-0x0000000000400000-0x0000000000584000-memory.dmp

              Filesize

              1.5MB

            • memory/2612-78-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/2612-72-0x0000000001A80000-0x0000000001AE0000-memory.dmp

              Filesize

              384KB

            • memory/2612-88-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/2612-86-0x0000000001A80000-0x0000000001AE0000-memory.dmp

              Filesize

              384KB

            • memory/2612-82-0x0000000001A80000-0x0000000001AE0000-memory.dmp

              Filesize

              384KB

            • memory/3048-235-0x0000000140000000-0x00000001400AB000-memory.dmp

              Filesize

              684KB

            • memory/3048-118-0x0000000140000000-0x00000001400AB000-memory.dmp

              Filesize

              684KB

            • memory/3136-279-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/3136-603-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/3420-187-0x0000000140000000-0x0000000140102000-memory.dmp

              Filesize

              1.0MB

            • memory/3420-560-0x0000000140000000-0x0000000140102000-memory.dmp

              Filesize

              1.0MB

            • memory/3584-247-0x0000000000400000-0x0000000000497000-memory.dmp

              Filesize

              604KB

            • memory/3584-129-0x0000000000400000-0x0000000000497000-memory.dmp

              Filesize

              604KB

            • memory/3816-90-0x0000000000DA0000-0x0000000000E00000-memory.dmp

              Filesize

              384KB

            • memory/3816-100-0x0000000140000000-0x00000001400B9000-memory.dmp

              Filesize

              740KB

            • memory/3980-26-0x0000000000680000-0x00000000006E0000-memory.dmp

              Filesize

              384KB

            • memory/3980-34-0x0000000140000000-0x00000001400A9000-memory.dmp

              Filesize

              676KB

            • memory/3980-35-0x0000000000680000-0x00000000006E0000-memory.dmp

              Filesize

              384KB

            • memory/4160-173-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/4160-58-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/4160-50-0x0000000000CD0000-0x0000000000D30000-memory.dmp

              Filesize

              384KB

            • memory/4160-56-0x0000000000CD0000-0x0000000000D30000-memory.dmp

              Filesize

              384KB

            • memory/4468-448-0x0000000140000000-0x0000000140096000-memory.dmp

              Filesize

              600KB

            • memory/4468-162-0x0000000140000000-0x0000000140096000-memory.dmp

              Filesize

              600KB

            • memory/4480-200-0x0000000140000000-0x00000001400E2000-memory.dmp

              Filesize

              904KB

            • memory/4480-596-0x0000000140000000-0x00000001400E2000-memory.dmp

              Filesize

              904KB

            • memory/4524-103-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/4524-223-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/4732-79-0x0000000000D80000-0x0000000000DE0000-memory.dmp

              Filesize

              384KB

            • memory/4732-81-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/4732-46-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/4732-47-0x0000000000D80000-0x0000000000DE0000-memory.dmp

              Filesize

              384KB

            • memory/4732-38-0x0000000000D80000-0x0000000000DE0000-memory.dmp

              Filesize

              384KB

            • memory/4764-174-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/4764-475-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/4776-601-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB

            • memory/4776-256-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB