Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 18:00

General

  • Target

    2024-06-11_9116bbc10f16d5e63bceacc7b95f10b5_bkransomware.exe

  • Size

    712KB

  • MD5

    9116bbc10f16d5e63bceacc7b95f10b5

  • SHA1

    9a0fe5f0858f7896e556357663cba948901ecdda

  • SHA256

    e68cc700df362dafe89ab449c1d08f5d5730704259dd059b85a1eea2caa11725

  • SHA512

    4a675d6ab7fd8fbc072396e839bbdb142d9cb567e36c2fb2d2fd9d7b99d2e8c64767ad81ba63c9ff9c29d66e4939fed159bf016b61844d8104b2a4788f08da3b

  • SSDEEP

    12288:qtOw6BaUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:k6B7atr0zAiX90z/F0jsFB3SQkO

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_9116bbc10f16d5e63bceacc7b95f10b5_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_9116bbc10f16d5e63bceacc7b95f10b5_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2912
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3428
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1420
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2636
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:224
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4836
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1348
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2372
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4936
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4276
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3056
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:5084
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3540
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:844
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:728
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1696
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2716
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2264
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:664
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3228
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4592
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4348
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2200
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1824
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2788

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

              Filesize

              2.1MB

              MD5

              2a89a6b35a51875760730e28c84fbdca

              SHA1

              56db2f1216001677f2c27744505c79d336af3541

              SHA256

              0a7eeffac518cbac8cb5d017f7f6dce75091ee0a8a68eec6f0cc774626f5bc5c

              SHA512

              0cac8660686eba328dfa41d1a6be6e9c9371a3330059bb43449ccab51c6673898ec7807635292fe6495724b9dc37e685c3ce76acaffaa86338e2751628e5e95b

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              797KB

              MD5

              eae540f2fc84e77d1f7f99a60893dff9

              SHA1

              1a2823af529c34396c43521b83f36b02325cf8ca

              SHA256

              1c38e4b96e83aa27401bf95dd52f828ae719904b49da50b2130c07ec65b6f17f

              SHA512

              97452a9ecdee82acc720f90a712e2591efa16082b822f2aa70feaffee0c8f9271fd9bac7d16d83efa7ef180f929b75cb9cb073fdac1186f3a6da2cd57ffeecdf

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              1.1MB

              MD5

              1e3431a5c23817a9d52f0fbe27482408

              SHA1

              f94276c67bdf90625dbf115abb0c1919205c1bda

              SHA256

              3f1ca50e4f809d121e696068c042f63af52043685e8ac1b1b61f4ed0f2ad53b1

              SHA512

              bf665d9aa7315383dd9890d3aa700ef33e6931d5f3744acf3ed127a9953dcecf32a2ab3835e2d4aed99e29aedaeb5c0460457258e047b5982350963106895986

            • C:\Program Files\7-Zip\7zFM.exe

              Filesize

              1.5MB

              MD5

              35331d4e6e933698307700adebcb608a

              SHA1

              eadf3c37191189777f6d44a55eb8b98c61c2dfd3

              SHA256

              cf1f5f2dfcb584c89456ee31ae5fe3ba95504fd615ae1d0242c7d623bdf13844

              SHA512

              55621cf4b5e535d7a04a5e0260f34f8ad448a248075aaccb60c0b0bb96b42407c3ab47adbb7d2ebf305288c237a1336dc6719c31d7666969c62189bf11c66481

            • C:\Program Files\7-Zip\7zG.exe

              Filesize

              1.2MB

              MD5

              246ea661e5f9210a31f2106af0535b0d

              SHA1

              0a76d5b5c97648c686f8e58827a9fd9c17e05cb2

              SHA256

              608bb6ec0931f0df9d27c16bd317ec1404e8bda0abe98aefa2dc80437e6f2d16

              SHA512

              5f247a6100250b8bad14b2ddc227a20830953e71504626aad573a6ea3653193fbdb0be8b8a4a3c8ed1e96e035851751793c855a45a8e781b3e7d01e50ab4640e

            • C:\Program Files\7-Zip\Uninstall.exe

              Filesize

              582KB

              MD5

              3429eecadfd951e7d005d06cb6a97125

              SHA1

              ce4b6e5427bfb9e4e69ed27be63bee7ca5e6632c

              SHA256

              111f39bb9ed3d19b399ced031e74447c3695db1b211b12f7f2eac210234fd33e

              SHA512

              341d781d748c7136c63ac936af8ad9a66fc4c4905f7613785ff1cb512301d7a061ba64fdd8b32e2883a8f81c94fc401bc469b0976a0309fa1de7fe13a9c5f0f5

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

              Filesize

              840KB

              MD5

              9ab165454787f346118d20d25143fd46

              SHA1

              ce43738ad4522315a9debddc638363b5fe080025

              SHA256

              9de6329c2a8975ab477cb0f02dca778c25a3daec8646b6f48fe4b7d6c1ba1b0e

              SHA512

              b99cefa20b7701be8dc48cde89e11e1382417abe615ae21b05222664b79d41a557f5131566325017a89c7af0bb639c530f081011a0b81084908128e3de911b76

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

              Filesize

              4.6MB

              MD5

              bf8b8018bc5e45dca297a81599ded9be

              SHA1

              1d2672a75139613531e38e1d221cd5fa9c695dbe

              SHA256

              9c9e4a9cd9ad30397bea71821e731e5d54cf70f22f19eb06ab2ea75aabb18e55

              SHA512

              15afc6946f24b6e6c57f47e9609331745128603dea0f3dba3f32d0888f45effbed1c18fb2c5fd00dc34b6b62ea4613080347cc84a6218eb37c345b272d3ea18b

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

              Filesize

              910KB

              MD5

              3badb9b040a7f8badea863d4088266df

              SHA1

              4c6558882b4da570c6cd959a1578257cd6591cf5

              SHA256

              85d755a1db14d3768a84e36e1ab85fd62bfe2e9f18cf3050b624cdad2a3d9b01

              SHA512

              fedca4770c54d6fae1bdd4f4dd978f688ee8398cd74ec959ede0247ed22eb62d67149026e7fa1a81b400c480123f4265052e217c464cc1515264094eb971aab2

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

              Filesize

              24.0MB

              MD5

              c5ecbdf28f15b48be815b63c0847f74c

              SHA1

              d784f99ef07f081c7791b73c25b5fbda089f3265

              SHA256

              3be504f987767c4a7a6bc3971b56e7a9e742ab22fb8ac05c4bd73711c6672caf

              SHA512

              2dbaa9c2ffd18e2a672a6a1fdcf5d222e477d35b7e673fb4992231c14ec08f556214da8b1a857da1dfa14235707dad82f7250dae9e0aacbd0a7f66aedb0df929

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

              Filesize

              2.7MB

              MD5

              d2e1ac087b925011a876fe0cf96352dd

              SHA1

              bbab4c6ac32825b492aa7d25423448c2307c70c6

              SHA256

              bb7803f740edcce908264a30c7604b345dcc2c8872effe5b89f98447e45b4ee8

              SHA512

              6d2b8a5b54ce024fe77cf57605d35daf372f2827ec7c96587c1791f82a8cb85fa3ac87bf36e3c5703b4e8d2d0723055f2ad0e2fea493d284dcd63f8f1735ba8d

            • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

              Filesize

              1.1MB

              MD5

              5ba42c892d8ad343a9a1797a6ceba1b1

              SHA1

              4e333161c5cd2ec7b7d1f773e3e0dc06b374c1a6

              SHA256

              0070987a4caf0c33860c8571a73928a023299c27ba37e8cc5b25d305014094d7

              SHA512

              9fa6113a3df37e64400e9c047a5543a0580210e27f280f1fadabb7285ac07649a867fb1da4d2a2e4c348469698243706ad5f8d10c554423c76feba07a30a19ab

            • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              805KB

              MD5

              09e8e46be87832e1cdb493883df1d19c

              SHA1

              574a9276488e44ca8f1ed8f07e98307ae6891e1f

              SHA256

              20d4fe9acbe2c717cdb971122b72f260c95c5ac33dc781c7e4851ed89dca8687

              SHA512

              a3f36f3da8b170d0fba7d5cb68acc9af984f7236a949f24be39d918ef31a22ef23db39c112c8c89f1f2e75f2f8a3f850b701c6b3ca84ffc784a92169bfa441a9

            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

              Filesize

              656KB

              MD5

              180ae4180078766f993ec99b08a09624

              SHA1

              70e75923ee11ccf8c5d3b7af5403020962b9bfa5

              SHA256

              d6c1bb926771511fac61afef95b58126e74031e7dd587cd75f44b7ffe1ebb926

              SHA512

              bad58577ef04b464cec4075abf8e255ab8de56f8ac62bb526c8502760375e8a6f768daa24129eb36642ab3a1f0ca548c5281541301f784ba9805d4e8704acf7a

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

              Filesize

              5.4MB

              MD5

              9aa6fedcdccecc4644a305d674315572

              SHA1

              3fb3d2ad6c46c9842cbb276b528003b7303a47a0

              SHA256

              4e2731eedc80af8bf0f3cd8734955d1e65375637a792e80c7c67749905de32ab

              SHA512

              38c30b66636fa59fdcb3ecc447523469d300ea04cf2bb6897c2233be66349e34133ef15fbfd0dffd74f97ef6ed24a44d748ad031548de39b57f5cfafbd9d61ef

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

              Filesize

              5.4MB

              MD5

              9704d70d2e09a851fe8caa5c0820a0c3

              SHA1

              ebc7508bbe4e4bb8b6ebf657b7e5ede68c918ca1

              SHA256

              6ea5501bbf0108e68894ae5984982239c558cda2b9f44192aa3287afca896e9f

              SHA512

              78da05d2096f8cb9ded67ef91a0203e0354e96138562ce5b371681360fb2bbf7f8d02192ae06cb05e84976c83be2465fe4112f1faff37ed73a643df81ddf21f3

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

              Filesize

              2.0MB

              MD5

              de5e95d0269d159903548fa15a826afd

              SHA1

              101ebaded91c70270abfb54ff890afe8e68fa9ef

              SHA256

              c45ce6f0ef88dad20379ae5f6614b4aaf636676b0b775d35b614bcff9998df95

              SHA512

              2a7dda2e22df22c1d880753afef6ac870a1ab679d45de69616c7c75e827182d07b64a815b0fd6a566e264f48a47111ca67e60cb2190cbff8f896f806dd254542

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

              Filesize

              2.2MB

              MD5

              db64341a98846926a46504f229cd754d

              SHA1

              3c70dacad20393ef619f391058313de460187bbf

              SHA256

              e9f38eb42ede5263ad020ca3d1a64941c758ca03a49583cf0e5abf152ba23412

              SHA512

              d5e0b8d501f798b1e90ae4a45d3a3c84130f005c95080f541a819299733f092ce830516703e3b0232066f9fcd1f3806f92f91b479109afaa38286e687ac042c5

            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

              Filesize

              1.8MB

              MD5

              ab547aee672cf0199a0d6dce2ba5c9eb

              SHA1

              af0a7f9cbe0ff0ea64f53d04b76cdc0ac49535f8

              SHA256

              a1a3bb77ecfd1efee92540d6357746820bafb432d9fc73dc3fe77a9b7b299ecf

              SHA512

              4599569eadeb9d24db311a7f391d24c7843e4ae9d34a42d978f0ef859ddc4040c41eae2762d336cb505708b55dacbc133b4564ef26277c12214f4c0d6dede618

            • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

              Filesize

              1.7MB

              MD5

              14b5a431119dd4253749cef3fd653352

              SHA1

              b507273710ce2209cfd94060fa24487b0f2ae30e

              SHA256

              0b912ed6d28b988d8f70b83876b596afd4e765c9a5e0b305aa1c1fce4742eaeb

              SHA512

              ecdb5f529e0f7d6ced0004154daa29107eff7082681da11d42c8fabbe16c0c595942bba815363ffa98890d304c625d4b662f4176a061895f615691fa71d82af0

            • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

              Filesize

              581KB

              MD5

              200e5895804b67e502025c8ee6d65c87

              SHA1

              0fb38d47c6af631f65b66024066b240d690b9b62

              SHA256

              49d73ab916104e4229c703792034db7ab7edf660672a98394711d884c9e4b113

              SHA512

              0a459c06f5e1e8042840eabfa84354fa8fddf8c43de08bb9b3a29414a70ee088b229314f0f7277fd605f9b2fb2d7ee7bcba513e37096a3e571d9b67c73ae7836

            • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

              Filesize

              581KB

              MD5

              841f361728d1bbe1e5887725a0e0432b

              SHA1

              e0c4bf9e4463d138bffff6e27e2113819285f1fd

              SHA256

              4e4ca843f4f2123de3538a844052f2983de535414740b4080bea9222ecf9413b

              SHA512

              1d0226a28168d9ee90888860e8443a38fe92f5324ffafba487b0a830bf42f15efec2d4feff5a2d5efb38174804f9a368631c9c587019d6d1c1311feb69e8ecef

            • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

              Filesize

              581KB

              MD5

              0a6e1921d15b2c6088ccd4d0ca95d4c7

              SHA1

              32617711415e07f39f8f0c37e935a2eff7748cb6

              SHA256

              e9f12da700bbbef61a0498d6b61191cea26d81b5c89f03c610592712396bb8ee

              SHA512

              826fefe043b2a7414915c7ecdc28789d0a70bd2ed4ced7977d64a6a51c91ee9e513926e88db98338862d42582353caffff1bfa67aeaaeaa40525f2a8fb5e7fa2

            • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

              Filesize

              601KB

              MD5

              f63d554a625bd19a2423edb7ec52961f

              SHA1

              4fb1fa5d192920c1c194267ea9a7ee2da2e723c0

              SHA256

              90aaf345f95cc7ba7d38c0079df248ff4ff40cd15470c656d6670892f2815667

              SHA512

              8c00ae2959f5e111eeb9b95ede06027ad0cd76b8fee044120c09e7fab5a6bf178c3da2a25586d5efc0aa19cfea4c994c5aae3cd83a44874d0cbe5cc83f901c8f

            • C:\Program Files\Java\jdk-1.8\bin\jar.exe

              Filesize

              581KB

              MD5

              98a16998c0f2cf6ca842c7a189f2cd9e

              SHA1

              35523178b10046ef2e360e89a8114a82bedaa4ee

              SHA256

              cbc3e9e4c72020aa0dd8f7f1651f4888092387b04f32c49825aa94e0b3daecd1

              SHA512

              3172031f98fba4a1b03fd4ff21c18e41026854db457a910a1ee7ea1e9b18fee253c47b6f940140932d0a4626e3fbe36e692447826aaffff267458cb45c6d30fa

            • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

              Filesize

              581KB

              MD5

              649ad264d86c8d78d80cb5970578eeb8

              SHA1

              2256ffc3154666dfd4da1af91eb0346653bed13b

              SHA256

              490ee97bc4968b08e51b8a4af49a3db95f94d80fa464e1ce7b7e496b83a8f661

              SHA512

              c45ca89dfa41ff596d8dc090a74d89ccaef3cb675ece37db6f62980216f60bdf9641475f76b063e15cb6f11f886f564dd68662eab2f66c2cbdf73a1daf9ff784

            • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

              Filesize

              581KB

              MD5

              863afde11b39550ead7acbbd7202c4bc

              SHA1

              183b5d111c1d9b3d7a15b7ca4d9e47d667db2c36

              SHA256

              05b4d54c2a01e4eeb0f7a42757ca81f1275bde532f3818a19ecaa538301d4956

              SHA512

              c442c62c6b94818b13d3258333f91da849d687aa33c8eadb72e62a1a0b26b7599827f012dc4dc0fff801eb2f0037f608b62d004daa6b41109a5453dbc9df83a1

            • C:\Program Files\Java\jdk-1.8\bin\java.exe

              Filesize

              841KB

              MD5

              6f72b0c3cc54af193fa6034e926a954c

              SHA1

              38ed7196006e967cbcf0b135154d579bdf07ab9c

              SHA256

              555da8ac5765ad434a500ef71f1678583878a6a51a9d2c24ddb9701d3feb5587

              SHA512

              44734468f2727f7e252f091e63732850babd5ffd8acb6aee32579810bb89f6e4d01143566aaf64e6ebd1fede0e6d45b94914e1494bfc1eb5557231c4769ebdcd

            • C:\Program Files\Java\jdk-1.8\bin\javac.exe

              Filesize

              581KB

              MD5

              58de1661399f769d9d56dc193be2befa

              SHA1

              32eb18540cb3d6d00e2585edc6353ec90f05a62b

              SHA256

              e5281766cddafe564daa687a27bdf3b87da96dc1f2bfa3d5e2369ce476ff46e5

              SHA512

              893d6188f71c6febd10a5197145e22215508b19ffc57187f9f363c474b4106d0417b91036dde8113b776c6dbc024bbbe7ee5c36c07778acbc8366cbc1534a997

            • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

              Filesize

              581KB

              MD5

              8dc80488431c401dd0df5b057043e045

              SHA1

              ce71bbcc97495c94714d653991a4e07ffdc6188d

              SHA256

              6babeaab11db196beff0d5e3ae06bb527c0856ad82aa3dc54939a52499f29e5e

              SHA512

              4c05f8a3374c601b6245c0ad34bb8f3a089ec551f2de35e9f9a4ed2b29c2a75dc3f07b0fa8826f71df6e8e25028eb7579f9012722b4815c067a02eb7eb8e43b9

            • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

              Filesize

              717KB

              MD5

              1a464c01b94e8101f1b435597249b7be

              SHA1

              53d58d7ac2cceb6c039efdf8b7bec738b6cc5d1e

              SHA256

              ebb6e78e30073bcd4c47a8749fa0e261af62562f9d802c9ec097ddbd7f2d43ca

              SHA512

              2c49ee5344730c5023ef2b44fe3e6b36a803f9bdbec2b35c07b2c49a0995210f0dbcd7a3eeed59d7e53815c867efd7a6ea885fd62fbdb1177ce8eeff10158080

            • C:\Program Files\Java\jdk-1.8\bin\javah.exe

              Filesize

              581KB

              MD5

              7258250e448679ce3651152488aea02c

              SHA1

              030443720124b7e5a5f9cfa0efa14244929be90b

              SHA256

              450c45ea43b0ea5ff59bea73896265c9c96e9f75f5d46e548670218b8844d3ef

              SHA512

              66bf0593c317b08794d3ca94cb936c1940ce0cf17b6793462b916b7a0e089b9ee231ab1963ae21841541b27dd8709af3289d80384f81a201eec106aa109aac08

            • C:\Program Files\Java\jdk-1.8\bin\javap.exe

              Filesize

              581KB

              MD5

              21b70d92838ca38eeaaa5080236dea11

              SHA1

              f90e772581f1add28bfd93ed08ff9dde86b32d6d

              SHA256

              afbd2ab03ca35d13ad0dc8a6e2443e40d59ac4ec97529905f34e01482eda282c

              SHA512

              c0b360615f7a32c87bddc79e7c31b297d51eca8a39fe83f0f0fa6c24f670be5cd4f02b37bc64be53f833811021522a8fa38949aba3befeccaf2d81da97e46bc7

            • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

              Filesize

              717KB

              MD5

              8aa87053452d42c9bb3cbc9272c19273

              SHA1

              d300ac6e41c75c238ca491ecb14543ff9fdabb05

              SHA256

              9ae525777f2fcc7f9200789dc4528d6c3f2a1f26e59f5e04f1cb1424b19f915b

              SHA512

              e50d8ffc0d602cfd11d987208a8b7d68bdd39188740639ac68cf7f1813031a45a329f0ad49db9817ba75fd2048b9edd536fbd398de53f98a312e8be0ed14903c

            • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

              Filesize

              841KB

              MD5

              0362a9b6bbc4303192f0bc8bfb77b2a3

              SHA1

              460945dc4c578088d00230d5271021bdc865b350

              SHA256

              a80af5ed0eefef910cc91fa49b26d5af12dc43eb914d0bac03fa1396707fc4be

              SHA512

              114fe181e45877cb4ef3683498373296c6a6b1065ce9b6eb7ff83b50899e199ab2044fac3aaf7e3d4175d3a26c76bcb9ebf1ff3d2efd2038fdf598370d8c1a78

            • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

              Filesize

              1020KB

              MD5

              265460e94b7470846acd1150bd8ab34a

              SHA1

              7216053bc313126eda0476c9cb22563e78d2d13e

              SHA256

              7dbb3d0c95698b6cca697a2aa47dc8566a1fc88dc2e59bb997a8794b133b261c

              SHA512

              113616056bb6a748f1afd67ad1f8c5a9df82bd846451030177a6274a902c9e9ab40a00508afc534eabcf76996e2eceea00e1509c3acbe43024fc7156a44e7eb5

            • C:\Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              1.5MB

              MD5

              ce700324367c35dcb3a5582eb224ca8e

              SHA1

              0efde3383ede0553f9dffac7a476a7d2ff05b6dc

              SHA256

              c7e4115869e7d47b0f6aac64e3aedba386779a3be1bca9db529a0dee2b951958

              SHA512

              8846e3971fca97ca70bceed71e45e34c4f8b22be8115b514708c8ad6bca343a7aa604fec09e8f172df2f18377ba01ddb1bab6348828a17522a02fdf88cb9e522

            • C:\Program Files\dotnet\dotnet.exe

              Filesize

              701KB

              MD5

              85f6f2b8afe25acdc985d221e85c1fef

              SHA1

              0f76a6b17975d59e34c9902bd83bc82ed6f98c6d

              SHA256

              3d3fd6c7f0159dc731f6e1673e94c20efdb8af68ad5ee642362cacb33d581357

              SHA512

              ee96cbe4333bb6d9168a880e39fecf60460ef57a18167b7e4e432a6403938185f6218208f183c8dc46328cdf542aa05d7584fd721185895691fa29afe9590eb8

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              588KB

              MD5

              04a0ece090e5541eb99f3c2cb22d3724

              SHA1

              6493340c69d6a20326cd1c1fbdfbcd8d687f2ada

              SHA256

              63e4cf0c73117b5268158de024f1b8b41a2df6d2177f27770f8d65407cdcf478

              SHA512

              1b0afd3f978d36b86b3cccbe38a9084d299e85df2dfb8d34f0c9e4559b119e3812e7ab1ae470e8fa4c9e0ebc1d5a12000b7fca93ea21594497e4d1ab89118064

            • C:\Windows\System32\AgentService.exe

              Filesize

              1.7MB

              MD5

              595392c85bff2f22219bc1699cf7c100

              SHA1

              1e3b4db4c276da7099f2a8d8d368b30c512532c4

              SHA256

              933300c25dd3a70ed63365fffdd9f37870511a4fb2f22af70dcc8d2d422a4326

              SHA512

              cbbc0ffa8d1443e5a5d77ea80e47e7819d5f779a07c9bfe49264faf07b4da940c32890654a4db60ef59ed428e2061b8b08f4eb1b9f17708680968e72a2679186

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

              Filesize

              659KB

              MD5

              d920387f5a334d0cd21dfae07f736be0

              SHA1

              b7837f32b4af64071991eaa670461a7f03b32e67

              SHA256

              0497ab7642e4d038cc5a9a5bc489cecccf1fe56f855948d11baf04973a76231c

              SHA512

              a3ad4f48234bd99505f3d80ddd0b58c0c17441b8f82778dda5494475ff56063922791b18e899313724241633a5caf58d06daa53352a8799b5e352a199e8ea9ad

            • C:\Windows\System32\FXSSVC.exe

              Filesize

              1.2MB

              MD5

              da6804d02e52cb0182de0a37dfcab1cb

              SHA1

              e6ec2c28d4e9ee9bb5351912ad5522aa805c4b1d

              SHA256

              5a309b9b26e65aadfc52f995624274794a6f712c8800b14973b553790d724762

              SHA512

              3a850f254ddba1340bc50d8e32f9b42039aba9ca0f19115c4187f87a76b5ec9246bfa8b837afb79c37d1d35eef606ef5ef4c2ca5fc8ed633b5f2ca09b562c06e

            • C:\Windows\System32\Locator.exe

              Filesize

              578KB

              MD5

              799232804cae284c68166fd74b6dfac3

              SHA1

              bfdae3e43998e5f624fd6327ff99ab484bed7cb3

              SHA256

              1dc2e90cfdebd30b9b86097301492e957fcd9c146f7a4d5df7f57ddc2c7f23c8

              SHA512

              b56139b5bd87c27225171483e949bb816e98bfe5361a4c08f184255709c93beceba5add1d1ddcf850b581216c9ad06ef97edb6bdba7d875910028af8e6aef7e8

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              940KB

              MD5

              c324cc7815b937f9fed0f26565aafcf4

              SHA1

              f593871bffbaec74a5e4516e320c8e01c81fa8cc

              SHA256

              e9802d61b1dcca14470544f49d46a5bc067412ef2f5da556a5ee37d0dea0be50

              SHA512

              d499d92179afaecc464393757d6cd5383bbdd95c552f78a380a831dd0a3d960fb4d0459623ae5dccf63fd94e58feadf768948fd86c948ddc7feb19b44d8925ca

            • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

              Filesize

              671KB

              MD5

              6afc7eb4138be41dc360050668a3a8b5

              SHA1

              f89065fce70c6848041d7644738ebc7ebcb64759

              SHA256

              f93790c2ed525d94c2984bf6af87ecf23879c463d6d42303ae1118a96fd9f076

              SHA512

              19bc6c2d3d02517d3c9cc08ec72b8646c44330a230cee76822b258d5220369bd249e1518dd73f9672163fbf9bf0ecbaa8e4bd9ab5ab7cf2fa8eb393d31844620

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.4MB

              MD5

              60ff85fb5ebe284ee590450bd2c110cb

              SHA1

              099ca71ed45661eaa569859daf11d5ad37f4a2ee

              SHA256

              9eb0223e315c4470dc0c4c6b6e54c9d2f72f8caae8257ab3708621437d628824

              SHA512

              8c21777e1ae5a5b2cb5949c376ddd8da4e894ab79f733ff02d3172943c9872ddac1f60d67260a4782b0e172cca912c2df9aa18e3d1d3dd7b27287bef5edb308c

            • C:\Windows\System32\SensorDataService.exe

              Filesize

              1.8MB

              MD5

              4de1a08e7a4c9cb85cf012a84587dc60

              SHA1

              aaceccee9f1309a619ad8a8cf235377624204b74

              SHA256

              1fda6672e11baccd5994d6302bee4891fd03fb5a8c0a2a141876153fb3220e9c

              SHA512

              2d0df7f4b7d68f77a7605d844670673fb970b17cbd5c48feaba825f119e2defb19241fbf88b79048be76899182bda9e9b423c71155dd569aa2c87aa4936ce3e1

            • C:\Windows\System32\Spectrum.exe

              Filesize

              1.4MB

              MD5

              80cd11835ae2b57d07ce50f2ef26c7b3

              SHA1

              7e327c14b6e1eae8dcc4df0d3b25af367786c726

              SHA256

              b4d140344c9bb1aec3d5aa03e296e2904b5e1d4879a5835fafb89bb6a4d479e7

              SHA512

              7f24a8cff2ed26a2320f4c50a323db999803855d20c99e385f34fa83da2669263af9ccfde2ee7eb8a67b94e3ff395504970f5e80dd1ff0fb1af157c0b7df9d45

            • C:\Windows\System32\TieringEngineService.exe

              Filesize

              885KB

              MD5

              691cd72b197e05f963ec2d62885fc024

              SHA1

              d78619e048d3f186b541a30d0bc782dcd9240ff8

              SHA256

              76af3dd6aa1e78d971cb84eea9c310e1d848d850144505757080c868948d6024

              SHA512

              9ece3d8cf9e69d07c97202f6951c8e62d9d01e655b6fd3438b725e09f4f450ca20c554d4c495d3c962be7bb7354071e8dcd9365345fc7b0352d6548c80df77b9

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.0MB

              MD5

              c75c68229686adeb02f9047cf8661ade

              SHA1

              1c5385efcf3acc17d55998255f8574efffbf34f1

              SHA256

              74289d99fd3193f62a00e9c340f95204c089450445e6905a0143face80af151e

              SHA512

              1598ff33184bac6864912f6538668f9a70aa34447c4bd2ddf8b563b5d9454304e45bcb3f15cc54d22e1a45290d5dfff5bf992a6c0022a5deaf1b859627fc6ab0

            • C:\Windows\System32\alg.exe

              Filesize

              661KB

              MD5

              242e26910ad5855316e020e22981c294

              SHA1

              f57b20c399454a4ba8e447d07ee49ee2eeb98869

              SHA256

              1dd93418edd6279631a1dbac89f6ba7731c33b31137d2e5aab6eee2ce512cc2b

              SHA512

              152c0041ee6755e40dbd9012371c643c1956c8fea59f5f8cdc960f04f423eaef92c2722d636596d7c8852cf130c1191b7a647df091fae27cdbbc1cfe9fa0f7a8

            • C:\Windows\System32\msdtc.exe

              Filesize

              712KB

              MD5

              b74aafdf790eff7f991c7fd3bb02c1c7

              SHA1

              097ca8b772e4a75b4c53bb44b8e644f201bd657d

              SHA256

              fba5201842ba934131efd5cd716d30923d72e80d25281622ed75d71eb270ce16

              SHA512

              54f50a44484f80ef74ab1674cfc75d2dd509ee4d0f7ef54253cc9a28779a216795fb214376f67b7ad66a7a9d19f5a28ada2698385b9675ad54051545d4705f81

            • C:\Windows\System32\snmptrap.exe

              Filesize

              584KB

              MD5

              77ef783a4d3d4c309b9c8c7b1f2ffa93

              SHA1

              74b8d4e9f340b2d8f56bf97464c1d42b612b82ca

              SHA256

              ab8a3c5b9b2bd4ee919e64e94c8dbffbdc9f7e78be4a95bf58cf15bc63663ba8

              SHA512

              fa920ac60d305012ca5569c091c1898b86a0cd3205476a37d792c69a306269aa52f05ce6af6c983bd68b1e59e319fbd4574ab8c5d61c65fa18608bf6b9eee338

            • C:\Windows\System32\vds.exe

              Filesize

              1.3MB

              MD5

              7e7d2ee9cb7b67f1551310acd1b6d707

              SHA1

              a48d0cbeef6c84e4c52745f82b897036e35728b1

              SHA256

              271e762bfc7a7db33b42f2508717ea7ece0a47455f68cae9544698e649ab3b5c

              SHA512

              2debfcc0697729f13bdc47f183338be399ceb9d6acb5713a4fad76f40eed0b2fc9cf85fe2a472e059e4eae9c59ba3d711db0b454a432fd955329b5fa013c4912

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              772KB

              MD5

              c3d9ec535056837b32fd4988f9837e99

              SHA1

              e653786d498bfd48c0e98626b066e68c785d9e7e

              SHA256

              06b014adb34763c352154433a9e4661e2e883a3f944dc04cfa23101f9e73e465

              SHA512

              0dcafde8c2a0c46507b221d00805a919fc3c9b24131a1bf23062980c98ba4ff73be2e606bb7f740f32b34490c6a141ff2cd6125d0128c0a20c423ee65b0611b3

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.1MB

              MD5

              f66325d2b1516c14fe08456fd64e5f20

              SHA1

              25045c754072c7166885d38e639a2f499b43284b

              SHA256

              98ca0a3a9d4832417736bb8ff1a948e4505de36eb6cf775cf8ae1681c2595979

              SHA512

              55ab418be3c5a807e7b80acaa699046868f579615b74a73071850746890bd6ce3c374751804b7bed85c97966fa573c105b165be5e9bf97c3cd085fed53664099

            • C:\Windows\system32\AppVClient.exe

              Filesize

              1.3MB

              MD5

              97470d802f746469042abae126978301

              SHA1

              685b2979add0b3647df5ce7ab41e372b5437bcd3

              SHA256

              b9dadc272698bbb4f66e2fc7e744138f14034c1480316b7bca05fd5baada1ee3

              SHA512

              01cdf20b3dae561488ef7c90312455614268d762ac5c5ca1b018990fd4d7d76e5bd181576344bf9248504ae46a7e328d76fdf5e46304eb2b642fe7b3fc88b409

            • C:\Windows\system32\SgrmBroker.exe

              Filesize

              877KB

              MD5

              ed7bc0f5bdb3c83b585b194a12c439e1

              SHA1

              50dcaa810678ff51aa0f4c603bfce16e45d6df08

              SHA256

              8a3bb14bc0917fc89f78c031b4ce2f52487e8ed85ca2d4a00a1da759a2cd37f2

              SHA512

              ab1c10706952647cc23f60e0d48ecdcb13c8a609c33b7275e4c7fce2eedeef564e915b6b4688fd1375f6fce2247ea7f25c1718ac71dc615aa410f0774c6fc654

            • C:\Windows\system32\msiexec.exe

              Filesize

              635KB

              MD5

              bc4e3bd0ae3cf5b9bfe3c8459dce5941

              SHA1

              c2d5c81fe944556e779fd7c34ea94bc49d6a46e8

              SHA256

              2776a026fe97f866792ae059c327afeb19c2e0335a71a02d44f522a6bb6a1622

              SHA512

              4471603b2d7f21fa34625174257c8b20fc5ace5e6496a3de15b6eca10b46caf6fe6feeb654dbc78d63ee53cde9242c0037c2f241048a9a70b83ad605d472a747

            • memory/224-58-0x0000000000E60000-0x0000000000EC0000-memory.dmp

              Filesize

              384KB

            • memory/224-43-0x0000000000E60000-0x0000000000EC0000-memory.dmp

              Filesize

              384KB

            • memory/224-45-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/224-37-0x0000000000E60000-0x0000000000EC0000-memory.dmp

              Filesize

              384KB

            • memory/224-60-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/664-260-0x0000000140000000-0x00000001400E2000-memory.dmp

              Filesize

              904KB

            • memory/728-257-0x0000000140000000-0x0000000140096000-memory.dmp

              Filesize

              600KB

            • memory/844-508-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/844-256-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/1348-610-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/1348-68-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/1348-70-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/1348-62-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/1420-33-0x0000000140000000-0x00000001400A9000-memory.dmp

              Filesize

              676KB

            • memory/1420-34-0x0000000000680000-0x00000000006E0000-memory.dmp

              Filesize

              384KB

            • memory/1420-25-0x0000000000680000-0x00000000006E0000-memory.dmp

              Filesize

              384KB

            • memory/1696-258-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/2200-613-0x0000000140000000-0x00000001400C6000-memory.dmp

              Filesize

              792KB

            • memory/2200-268-0x0000000140000000-0x00000001400C6000-memory.dmp

              Filesize

              792KB

            • memory/2372-79-0x0000000000C10000-0x0000000000C70000-memory.dmp

              Filesize

              384KB

            • memory/2372-73-0x0000000000C10000-0x0000000000C70000-memory.dmp

              Filesize

              384KB

            • memory/2372-83-0x0000000000C10000-0x0000000000C70000-memory.dmp

              Filesize

              384KB

            • memory/2372-85-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/2500-614-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/2500-269-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/2716-259-0x0000000140000000-0x0000000140102000-memory.dmp

              Filesize

              1.0MB

            • memory/2912-431-0x0000000000400000-0x0000000000584000-memory.dmp

              Filesize

              1.5MB

            • memory/2912-0-0x0000000000400000-0x0000000000584000-memory.dmp

              Filesize

              1.5MB

            • memory/2912-6-0x0000000002300000-0x0000000002367000-memory.dmp

              Filesize

              412KB

            • memory/2912-2-0x0000000002300000-0x0000000002367000-memory.dmp

              Filesize

              412KB

            • memory/3056-253-0x0000000140000000-0x00000001400AB000-memory.dmp

              Filesize

              684KB

            • memory/3228-198-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/3428-19-0x0000000140000000-0x00000001400AA000-memory.dmp

              Filesize

              680KB

            • memory/3428-11-0x00000000007B0000-0x0000000000810000-memory.dmp

              Filesize

              384KB

            • memory/3428-485-0x0000000140000000-0x00000001400AA000-memory.dmp

              Filesize

              680KB

            • memory/3428-20-0x00000000007B0000-0x0000000000810000-memory.dmp

              Filesize

              384KB

            • memory/3540-255-0x0000000140000000-0x0000000140095000-memory.dmp

              Filesize

              596KB

            • memory/4276-99-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/4276-611-0x0000000140000000-0x00000001400CF000-memory.dmp

              Filesize

              828KB

            • memory/4348-267-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB

            • memory/4368-612-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4368-263-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4592-262-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/4836-56-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/4836-48-0x0000000000810000-0x0000000000870000-memory.dmp

              Filesize

              384KB

            • memory/4836-607-0x0000000140000000-0x000000014024B000-memory.dmp

              Filesize

              2.3MB

            • memory/4836-54-0x0000000000810000-0x0000000000870000-memory.dmp

              Filesize

              384KB

            • memory/4936-98-0x0000000140000000-0x00000001400B9000-memory.dmp

              Filesize

              740KB

            • memory/4936-87-0x0000000000D90000-0x0000000000DF0000-memory.dmp

              Filesize

              384KB

            • memory/5084-254-0x0000000000400000-0x0000000000497000-memory.dmp

              Filesize

              604KB