Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 18:03

General

  • Target

    2024-06-12_ec76a3c1872882a5ceaef4d73468c028_bkransomware.exe

  • Size

    1.3MB

  • MD5

    ec76a3c1872882a5ceaef4d73468c028

  • SHA1

    eabd10a9af039e394637d89f52f91a388d73484c

  • SHA256

    e478e1c6034c5f6f2a2078d496b02859ef975af9bd63dc59c7aebda2912cc516

  • SHA512

    e37bc18d812803376024eb00fe0db8c56dec7c7a6f689914703243351f6dc97650fa91d63d4ee5a6e47b8c166fc00bd896fa73dbdf9b2736f3462b1b1fa57b0f

  • SSDEEP

    12288:YtOw6BakYlc+pFByStv9JRa//inz86NRo1qiRlUWC4kXzVC3:m6BAc+pFB5z+//ufNRoZW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_ec76a3c1872882a5ceaef4d73468c028_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_ec76a3c1872882a5ceaef4d73468c028_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:720
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4928
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4632
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1192
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3492
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4488
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3012
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3132
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2876
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1900
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3080
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3732
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2232
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2832
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3860
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4224
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2064
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:2348
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4648
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4076
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2024
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4880
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3792
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:528
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3040

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

        Filesize

        2.1MB

        MD5

        f67cbb007a0183fe52dc5d55d37c2ebc

        SHA1

        7cbf4ca56d1cd0b48698bb99cb241e1ab6819d4e

        SHA256

        5674f18da5dacb82099795bbd339ea702f8514971154dbcd28b5f1c09a9c1f74

        SHA512

        54a1b400aa3e5c2e0b0f1725aa797b8695ec043c14847f6b16b6dec82a1089c741b33330a6a14b8bac7c9a169afceafb34c63596377bacc4b462436f57f33413

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        1.4MB

        MD5

        da2565246124da9ef404f53b199c6335

        SHA1

        05aa97ed76ec4bc77316de7f2637e8844bde9dc0

        SHA256

        be3604d6cdc861a710edb71669a14950a719b0104a629e0a589be6aa3ce75176

        SHA512

        c714b619411267c1b4b6bdf77b58c27cd7df7467246d8a602dcfa3ac1aa04416a9d70a94c795ed022fd97a82eab9d5435b6a0d338947149efd0310d27b2c70f8

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        1.7MB

        MD5

        f790d3a9fcd217919abba0437791f714

        SHA1

        47d2faa218da4dca9146b7df84b87f555364492f

        SHA256

        c04c1480a5b9f74dbc18d231b2b188b4135a16686e2128c8505b991709163feb

        SHA512

        46fa61543968538f9d9c8addd95280c9538e617ec1365883e286acef0f10135b5fd27e2d89badbf823783a1ff011c31670c5e43da69379e4d0eb55c34c8f73d0

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        1.5MB

        MD5

        5d9c14d61467976f1e1fa48a8701a8f8

        SHA1

        55dc435ee6a2c089c0d68b9148cb332efb59d7d8

        SHA256

        556c2247cd937f8db17dfef420b666b4789d538d0623e2c5bf492f3bb29989b6

        SHA512

        8f838737a0b8401a014dbdc66aec4127cc5c3ef98c366b8f7c1be6e07f57c86fed115d2bfc8faf38e10240e2c87da8173c38403c01bc98aa2de84d438e60f1b8

      • C:\Program Files\7-Zip\7zG.exe

        Filesize

        1.2MB

        MD5

        0e7faa1eb1cc6987c338e4291b299498

        SHA1

        884d62dd7d16b266cce0d72c9477a454489ff7a3

        SHA256

        60966ea84500f408d606bebee6ad479eed2fd41a9ccd51c838106a7be066a91e

        SHA512

        271154f7efdd16a9524343678133d263ff75aef169426b9d9eb471e4944bd1f26cb7880e36c929ede99828ea2d326e374704ecd0923a653cd6fa04fd353e638e

      • C:\Program Files\7-Zip\Uninstall.exe

        Filesize

        1.2MB

        MD5

        d24ce468b6c91885a3b0795421060256

        SHA1

        0358892e3091fc6092f14f0fcf593094d26a224a

        SHA256

        3aef477307daf5e6b689fa86b86cfd8a50831f0e35be7ad3d241c4650d37d3f9

        SHA512

        de91dcb6784847bceff9acd0454a9e733e574b5940ea82728a83a1dff0ec52c3503d874f4531694070ec1dc79327f36f6051c31fddb0ba257d90802da559f4e8

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

        Filesize

        1.4MB

        MD5

        b4034d52c5d60e74f820a53d39cf29e0

        SHA1

        60a2b3cfe8821d0b727d073804b2b033672bcbc1

        SHA256

        03dbcd08b4873e483ec2340cca93b7d646c20eccf67008db1fa7fd971dd700e1

        SHA512

        0a6a41a7a978caec7d8d8e224dc353f8a3c01d196c8965975c10d5d7fece2870c3d5d2cb2102b991556cdb64c2328b683083a6c56d6950481b2b4b8a658e027e

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

        Filesize

        4.6MB

        MD5

        493687a58713b190cd42d802e25507d8

        SHA1

        8ecb3d00197c371d13ea1b84107b350001b927e2

        SHA256

        f1ff3b0c6132d4b5dfed9d0d9d3d3d4010f7ffa742148caf3ff77021c85e2d61

        SHA512

        94f51bf713c52d503df9909a5c0eb214757bd3aa112c117b009ac76a103b2fd4eaa4cec56da97d6120a37e49a8a7e0242380e78d97e109f532287a395d86f58e

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

        Filesize

        1.5MB

        MD5

        a8631a0180efcb173896633683220df0

        SHA1

        0a3df29dcc1642d4bbd49261c3f0cfe029f76a1b

        SHA256

        d7c88f8506e03edd567f3168338758683c4f737f8182dc68e64f6c88686d8b82

        SHA512

        fa046bc81c1659207447a4d0ea749449550b799346efd526f6b76b273e6e51334b372410b9563cfd2065f762570aafde7d2b19671cfbcfbd0cfd0b087b007397

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

        Filesize

        24.0MB

        MD5

        2d0be33e3d651efdd3df6af39f4f94a4

        SHA1

        9aaf1e9f95246ca45f4c50d56e72d12d3750b2b6

        SHA256

        a7674500f733ee7b7e1ab83fef2e8ead0e4b8eeb61a1869a654cd03b16373a37

        SHA512

        c8c9097446a32a9bad8394bbeadd68c130577eb9603ddfa5d7f18df1ea1ef64fc0a9196a5958c05fe1aa90448edea58c4c097fc51d78ffc10b543d10908e16b2

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

        Filesize

        2.7MB

        MD5

        9e40c4629829b09a17cea191a15ee472

        SHA1

        c81ca53a06c1231af817300d8efd1728aaf4a69e

        SHA256

        74942b42139ce78fea20898355b982fe7360a1cd506f3c18360e788855911229

        SHA512

        9efa168d472d1baadad766cd7a2b5f87f85b4398e55c18dcde7e317419dbe5ca32731f4b08d19101e439a605881367f7c9a12e1fc12c7c94c7eac6c1646b3b42

      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

        Filesize

        1.1MB

        MD5

        9226c77309d60cb795351664e8f86283

        SHA1

        180c2d18e50af03cc9fd120a7baa27c8f6905d68

        SHA256

        bcf03209225f02341997b463736c5ef7d64aef6ef6550a7b5ccf265433894fbf

        SHA512

        beafd9ef5a92bae05840cf7565203d74a5a49c1d9daccfc3d367808e9463d3df51fcba6b1de4ad8732821883030ee7304a3810a9e678fe06ace19d925105b9a3

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

        Filesize

        1.4MB

        MD5

        160f3a928f8c55fcb3101e22635f3189

        SHA1

        4ebca4b853b9545b99ff971e21cef5b22885f7fe

        SHA256

        91349f56f48e6990d37739bd0703b297e1434bfda3664634d6ba9d905c6aab9e

        SHA512

        8f2286cf33d6f9b81ab8ae62b2395b7dd2cb709cbedbe20247902c1d40cee57715c44ae28178182bbd158b861a8b8a2520b1e7ed45c93851f6e056da257a6993

      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

        Filesize

        1.3MB

        MD5

        992fd5b887fb66f55ba5a97cc17973b8

        SHA1

        51b60f818fe6417f96061b8cdffa1727915219ae

        SHA256

        5852179008174977f738e62bb8f897ebdc006a7c75911f02330f98df5901f261

        SHA512

        b45bf085ab703dff422e91d2a713932ccb46df673a20086a691c41f9938dd52b92e3852da864802ceab58d9acc15dce9f8e18191aaef05c9ca26c6b5d2d5ba10

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

        Filesize

        5.4MB

        MD5

        14bee8de761a2f2f60020b96fa18afce

        SHA1

        bc4ef6cea0f3a6dc12b8602f366e4f75d29892a5

        SHA256

        0a54b5d3b6512011156a2e960aebc3b9b3303fa634cc26717b1b6262693d95ca

        SHA512

        a5c6b4c8357b0f91b64802ae90568070311f930e71885e967550089bcdf8831aac888bc8689787d737ec509321e2fd06c8de4a9249ba81a2cae0de9e71eb9b7c

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

        Filesize

        5.4MB

        MD5

        d50dcd5f85a647a07ee2b3a6e7a29447

        SHA1

        9c9000cecb5fdeee2b1d08c1af6ffd7be14ab808

        SHA256

        9f94d08a9c7944ea210cb0acc984c88d9116e20143399ac51c0f6b759107d095

        SHA512

        262775416c061efada4795e517625daf3b47683f6b5e47fc406f75a33bb4e9118db865565517f8aa5dc3b32d0880ebee0f9ae7cf1c7ca344a2de7f94d552285e

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

        Filesize

        2.0MB

        MD5

        a02402183df36b6c8bfd2332ec030a58

        SHA1

        34e0b9c7197f60a8db7bb9646e59030bb7440d83

        SHA256

        3cb8bd97cc687f3c25c404f5016198d6f819353cdb2dbb7fa7b4247fb24b2162

        SHA512

        b18608773715d787b09accf56e8ad435cb2ce4e1a4a12dcb4baa34c2b32f90d9722c767a8a5b5f8b8c105578e0572ec186d7953fb6b6e20cb2d653ad6e9492e7

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

        Filesize

        2.2MB

        MD5

        d4f4758aba93c1ac9d27c42dd1a682a5

        SHA1

        4f38d75d580514bd47dfab41c22221f509e9a745

        SHA256

        ac3225159a23a267cd7de76496ae006a017ee5aa961ca3447ecba808fc694c18

        SHA512

        b6e983a026384737332a50391ff5004cb7ff2c11d9d65342fa1cff97f0995f8ab73586f1f97bf76630f1e0a87ab54aefbe7fa56509c7b54e150432b16bdb4c71

      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

        Filesize

        1.8MB

        MD5

        d35c699f5186ad2bf615f507fd79ae0f

        SHA1

        2aa1979b7c2f0f3e614de723834e7079b7afe2be

        SHA256

        b5c78100050d01e4a57927d3d3fbba984893afb34b510e7dd93b9eaaddc1fff5

        SHA512

        133a37c6dc405e92bd32e8c7b9d51fd5581917a9d8da1b5c2b4f9c22c132d89147e435c5555ef941b0e4bd56af9323b252b8a69d0541b8f118035a5a4b3f348c

      • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

        Filesize

        1.7MB

        MD5

        96276e5ecdeb48e6e4524a0ce4c77775

        SHA1

        20dfba44327c206afddbc3f9436bac85270c740e

        SHA256

        9541defdc5be5bdab1468adaad4ca1bcf381ea1c01f356b0b4345098e7f68d66

        SHA512

        28e17a5833ac03f02707e377cadab7291619f2f6b462eda15d0de965201e9e3b6c26c2c86e33c3764da297ee7168e9b2ddd877e569079afca57e6aa37c96f0e7

      • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

        Filesize

        1.2MB

        MD5

        b7fc6450d6be10c480658a9421aa3c5d

        SHA1

        437bf671fd1423a4176e2aaf2810b039c679845a

        SHA256

        c89f890537ab54efa87335fbf19a9407a1205fbecf7427ee27eea7fb53f8956d

        SHA512

        3be20dc56165e6d0d9ee8283df2cf965b0042b689775ff28fcd9daa31a830e6d8ca0fe629bec841a0345559dee1e8834fdea9de58f843f501f8ab689b3deaa79

      • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

        Filesize

        1.2MB

        MD5

        e3fec1ca3660da4d4f6d1b2879e8f0a3

        SHA1

        2c558d860e490c89c0cac43b0c5dacb088e15143

        SHA256

        6ac7c51a4f74d3ed18c0df6fb923a656d10c7f7a1c1ef14adef23c3c77f512c6

        SHA512

        96551c420a6f908323f2568f1c1d71fe5eb55771ab25065ea2ffa3173383a8d86b671f26f15b299db5e024b7fb79c2012e264c0b5b412e1d7094e7854671b34f

      • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

        Filesize

        1.2MB

        MD5

        90ced1f70879d2d9b0aa6eb68d4e8043

        SHA1

        b4674b84ba8d94fe2e095d6e7ab0eab5cffb5fb4

        SHA256

        6a9a63e071580dad45e6aaa367991851db2d597239f96c3c71baeda5e9c287fe

        SHA512

        1c00c867b64fd5cce6212156f792c081d89131d3390fc3032a4eeb3d1ab7b85bff074bf4e6c563b7f45c6012c484d4cfbb0f5e53724b503e6614fc34b2fbd7d6

      • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

        Filesize

        1.2MB

        MD5

        53440cb86c36a77fc6228aef2ac0cd17

        SHA1

        aad51303ad6c63cb974f8a95b95a29bdda42958f

        SHA256

        63316c60aaf69da3c487a5f9e9a49b680f997856ccc494ae55ddb9d9247e7230

        SHA512

        32e8d9bcc30e95e5e08b667222a17d4fddffb87372bdba9e8697563fdbee23eb37ccff0ae140c0da546ce7f19bde1af514b41775ebcf04e3bc22d07f0d0b996e

      • C:\Program Files\Java\jdk-1.8\bin\jar.exe

        Filesize

        1.2MB

        MD5

        6b12e62598e09af2dd2ae7f29fa93d36

        SHA1

        94442547ee5c8c6d1302804c06efa830a1d76a0f

        SHA256

        c7d62f5d77471df05b2f1e94f4ac048a8896b72b231ce625e8fb0762f8b7abe0

        SHA512

        5ce6bc0fadee72f7b11438df9a4192035962fd534404c8173661f02c241a23f102e44ab3713fb4612c79b08e189ea4589b684afe01cfa46529f466df39711757

      • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

        Filesize

        1.2MB

        MD5

        cbfa1fbb15ed0e89cdcc1b29f4af5214

        SHA1

        c38ce329cb3e627f058800bb9e5e6e82fb32c463

        SHA256

        28e72a6656b416c260c1e5d94f3d3e2cf36a19e2b01e68fbe5502649df3159d3

        SHA512

        453c61faeab47d4c752fb3df6aa4eec456cdee9faf3c730eaee07524c061926f18c0402a8107c64609a7a06311f7a74219f2ca254bd6eb4c02e8d2934c04d862

      • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

        Filesize

        1.2MB

        MD5

        7c9d773939caa2a341a101787376345a

        SHA1

        5bcbe6e7612c29da174c54b9c6d33b64356a5b26

        SHA256

        c713a3890517aaf05e6ec90631d84a1f82b61d39e36208d2d2f6accc747ec690

        SHA512

        8df87280c370d64b8ba922f45cb3196f5cc31b9b169f1f3802c9ce528a96e3e671d1ece6bed94e2a0adf0c6f735e1854d7ea065d369cc835d7fc6277e4270ee1

      • C:\Program Files\Java\jdk-1.8\bin\java.exe

        Filesize

        1.4MB

        MD5

        cb25b7a625b5d7e20f79b2d8f9c6686d

        SHA1

        5614cf13aefda21c8decbadfb66033cb7014d000

        SHA256

        7b462583c1d80336ec350ca8947cff51d90637b3e159b5fc487b1a7aa40f9b62

        SHA512

        22fd28027202230921e63cf4e8a41d869cdc926a070bd7456f56b7d6dda2eeded38addd67748edd2710b10ac28ecf81413a1c00962b48c9d132dc74417d1fdbb

      • C:\Program Files\Java\jdk-1.8\bin\javac.exe

        Filesize

        1.2MB

        MD5

        37204fbc6d8872d6bcdfe0037c698f60

        SHA1

        9c1b7d32914041836e202f70ae1bd7335ae1f807

        SHA256

        139af29fa345803d84ccd230f2bbdf907edc7ed693f8e307dd61263dd2bb3b18

        SHA512

        c2e1dad072dc72ec31edc157c6e992b117113f726e3884f47931e8106771817f3fa4af0ad9f2225aa41179ceb919dfab52d35cf491178fb43d6d7069e8517e3a

      • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

        Filesize

        1.2MB

        MD5

        df1c936f437139cf63e7b657509f6a45

        SHA1

        dc053e90de8a131a9c8d2cb48241ea4e4de87374

        SHA256

        0afc43a8d50eee5fc530534499de5489a1978a7e0774b71bfd433b9922a1b51f

        SHA512

        597a00f57e05b2b62e2db8f2d010f05d38c12da126e277b4bf9c0b895e33a292ceba24055e81bf2b5fd520f23424ef6f42f10c2170ff57c2b11915082a95df75

      • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

        Filesize

        1.3MB

        MD5

        e31f87f1a733f93acfc1f7278e4530ff

        SHA1

        a3cd39829fffb37e347c96cbb23b7d6a25c4a8d5

        SHA256

        2bbd5aabb58d77a690f229a3920dca77a926236c90b1c335b090bd975eff6fbb

        SHA512

        18ce6e5eeb37cc43baa18877bdc2af5eb259c1ba5e9a02d5daa6490ef3a5e7d813a4a15aaf14f16261aab963b791fb8b34e12e994d83afacf1c38e7de9d4ec8c

      • C:\Program Files\Java\jdk-1.8\bin\javah.exe

        Filesize

        1.2MB

        MD5

        5e526a6e64ddc80ae3b06c902c20a692

        SHA1

        bf0d4d92a5b5c04fd63a9e48463994763233bad0

        SHA256

        ef57283d6df764817569c3d986fbf3e2e5a3cdc4709b58814dd6d4f2247d9882

        SHA512

        1a291ca730c547831f5e0325d515be6f31762625f6a5819412f763538cc0b5ee4e8203b38a0e2ded4f8ce55d377f704ec6f571c3757893312af329a1b22f26a5

      • C:\Program Files\Java\jdk-1.8\bin\javap.exe

        Filesize

        1.2MB

        MD5

        1917f1b62d4811df625026f670533811

        SHA1

        fd626d50719a6a581db4f7f0d749a0addf72f55e

        SHA256

        25b405a17a9856def699c34d73bc0ca9a76a0cd08929b7371bccbb4143b5a5ea

        SHA512

        ed1374a9d58a8bd7cee49eca87bf6843f148a59b73d87c0fcc81a8ef8ef9482419ad934b91c8ec6f6779eb0dadc8f61db36642f2f6c0755377a1ac22123baa69

      • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

        Filesize

        1.3MB

        MD5

        6cbe5c00e1a1ada33a0f7a5613798a62

        SHA1

        9042def6a86f15da832fbd23a8dd2636886f1917

        SHA256

        454e45257b2f1556072bd6633824c4a02c8f60c79d87e56a6aed4fc9ff001af9

        SHA512

        a166e13d37e7a000cbded440cbab08b3ff6e5e2b2966a23f324796f92743e98a3142f1f888dc446cc1f6766eec6c05f54ed7e00b9617727c0f4566dbaf0e6f9c

      • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

        Filesize

        1.4MB

        MD5

        a9573cefb7958079ed192f9baa503d0e

        SHA1

        35b8fd9a5acf54fe5527c0572bdfa68756ddf34a

        SHA256

        bb2b69bfa21e1bc53c0cd5201218bc747599f70860072763e6787e49692e97d0

        SHA512

        8e96879fbb50a867cdd278a5d6ec03522e28b041f7d62500898804a4b22976a3f88f29b9c431e98debf08ce582dc7c30bedee2918054e42551e85450770f6eca

      • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

        Filesize

        1.6MB

        MD5

        b54cf74f785faa0900677012e37f130a

        SHA1

        c3196042bf3ab8867ab651af7e76dcdce29c410b

        SHA256

        259a63a0d4c3d63e781b675b1ad4b137156cf308feec1dc5fb92da38e72d5865

        SHA512

        1183247d2260022d3e732434a3c5a040d3f5f9e573c7f515c521808283c81c01017bafb4ee72e13ff9618828155cab92c7d94b93503ab61aaf1a2f5539ea4246

      • C:\Program Files\Windows Media Player\wmpnetwk.exe

        Filesize

        1.5MB

        MD5

        417878028bde4ba14165c125dee1bb08

        SHA1

        5bb4c12b06e1edfffe2f80f42a810acf22ab7420

        SHA256

        d5d88bbcaf42905871e615c1a4e8ba21a2eca28c95b800c3959c79b561950012

        SHA512

        573ac4f818f174a5f1348aceb457a5f2cb7595c12a1c0e7128f97fe97090d3bfd4aebd60b751c44ac3ca75bb77fbc50bfb601894f3bf518d4fc96bed0225597c

      • C:\Program Files\dotnet\dotnet.exe

        Filesize

        1.3MB

        MD5

        e21d7658c99579eebf653efb074e84e0

        SHA1

        484fe45485c374867eaf3e6f7df0123b18abfe58

        SHA256

        efdb1091306e5fb169f6b5ae98486b8b378a02318f897689922c50ed75a3b501

        SHA512

        764f69256a3fffef16f04d6c4ea6e69eafe7fac98dbc97c63bec19f1727f0e3c3919addebf250b10b944a7f204ebd3ba81e1b02bc2a4b1951ab20382f672987a

      • C:\Windows\SysWOW64\perfhost.exe

        Filesize

        1.2MB

        MD5

        2f03b6dc00db0328d6530bad74b72a44

        SHA1

        d4a2a52e71a02cc534899d1fce5d2bdb1c5b6b02

        SHA256

        163b0ec5e4023cb2c2fe768839fbf53e9a0480b8de9fc8292aefd3161a44bd03

        SHA512

        e2295cfbeec103433cbe869bf05f9ce0e5a54342bd90cf8912b1a78e0089afe1c37761964fd29ee28b68e6c88d0c133dc08725adc83caa4b758efaf558e27ec3

      • C:\Windows\System32\AgentService.exe

        Filesize

        1.7MB

        MD5

        1dc5eaea9c46aa4e54b95c04476b6ecc

        SHA1

        7e128db6af557d81dac36c396d317e8305f71d3b

        SHA256

        b4ae911d2f15b9c1af96a8674ef87bfc86661cf60a248282e73f50514bb9f7c0

        SHA512

        15ae754bbaf5e542ece9b3b7534ac97280f67d19238d4ce76b85e166d8eb789610c2a8ab20958f34c3f2d4a752c97cf52efc3357a79da78de228dd0dd03ce3bf

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

        Filesize

        1.3MB

        MD5

        4180c98e1e7c5e8fd1872e3c20d77624

        SHA1

        20d7d6255fd4635845fbd226aa6640edf88bb451

        SHA256

        abc7d8e28312e0fa15a01c252dbbb30ed158323a4447658be93ce4521fa167da

        SHA512

        a95b74cc6878d36be2675c81a0224c752c181afffff88d5687a8dd60340f972677721f46f83cf560fa51f422272cd8e2974b655021da4774b75586a5cabb525c

      • C:\Windows\System32\FXSSVC.exe

        Filesize

        1.2MB

        MD5

        6ebfd04f600a94e572a20c14fd5312e6

        SHA1

        62869cf419ac7279280ff35d122852900c3668ce

        SHA256

        5c27ea85f4b8ae954b2441b82665b07a9b8b144ce98571ca9fa5391682f7bbac

        SHA512

        534784e0559af13f6f3a4bd483ff52fff2f958fd8635c27b53fb76ab8bcacfe642dba49f562bf048dc7c0817b9a9c6f9582a310483d15e3091568bd43937506b

      • C:\Windows\System32\Locator.exe

        Filesize

        1.2MB

        MD5

        9eaf6244efefed800209d17f7a4dc947

        SHA1

        375703346e2c58c0b627ab4e620839e9c0744e3d

        SHA256

        3019afdda5087e97f4ca07693ec3a3dd2dbaec13e2516fbc0bc9bc1e30568c2d

        SHA512

        29ee0c56d1786ff7d41109af0ceed759a08129bf15591fe9ac240709026cac00cb11c0a7a8b9079c59e9d723fc7265bdcb0b5718f741ea0409b62ab6b1a606fa

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        1.5MB

        MD5

        161f63b6d5df0ff6618f0616f779a07b

        SHA1

        9a5649219efeafa81d9a7cf732fecb748e12cf9d

        SHA256

        a7b0d5627903ab1f0e0d15a33a36fa74bb098c9ef49baad7b44127c57d676071

        SHA512

        f93aeef71bc17ea0856d34ab053ae0ccd6dbf3470a28f78da721345565b83f90df5fb62059e36216dc20aa12633ce70d42044ea02cde4bc3f46150a81924ee93

      • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

        Filesize

        1.3MB

        MD5

        07041ec10bcee231386ae9489ac7888a

        SHA1

        176a0bf2aefd9db3a731c47c4bb684b7dfa87a7b

        SHA256

        b4b5e4457ff2a4d93b6c483126ffae374e1ca701de229cac5299ae075611c949

        SHA512

        dd66be714f87ff5b22a2788d063c76426d4613f5dd1a8a11ed7e1010c0788c75cde4355e7ee72b337a98f54def32569b5c9c50c8513c9ef7e6b95853254faf2e

      • C:\Windows\System32\SearchIndexer.exe

        Filesize

        1.4MB

        MD5

        159c93f1a774d5860e8f4350d4902326

        SHA1

        45ff62d3c5f158de1c1090eca338dca4e7bdac02

        SHA256

        26cae63e85e615672dfcebc8e1168619dbbd8b712bd24581172ab70ab1b86819

        SHA512

        80d55a32a0f5e3deb0d76a0ef09caacbdf2428551159236dd9f076592717a0f47b12060a3ac1a0996995e39caa11bfac8ae75dbf36f2f63d51835fb52fc72366

      • C:\Windows\System32\SensorDataService.exe

        Filesize

        1.8MB

        MD5

        e239858b899b8e8a101c49e42a455bab

        SHA1

        20223039a7cbaee9d85aae830ccae7b2a480d986

        SHA256

        24e004341ef33bf97ea096368fa8a67762ce5ef8c089b4093ed2a7d7783102db

        SHA512

        7feaa22540174cc1af3969fd3276d1666af200b397881ad8cf481ac582309f0fedab6b5bf67bec1e3af39c32feb523d20d294dbb2ddec9c825742aecbd633010

      • C:\Windows\System32\Spectrum.exe

        Filesize

        1.4MB

        MD5

        3d4587c6ea29397b87f3cbb118dd704e

        SHA1

        4f49c46f9f4fcbcd997e24333cfde05643463b6d

        SHA256

        67be3751f70fe2ea6e5738fcf5d16e827eaa209149c2919e8584fef566318781

        SHA512

        41cf0180a7e6bc9d73a9777f8c93b25bab0100ffcc7948964d74ed2f1d2f371ed97c839aca4a58b2547caf31833071dfc79cb94ca7a99fe3f4c2ad6936c9907d

      • C:\Windows\System32\TieringEngineService.exe

        Filesize

        1.5MB

        MD5

        ba91ffb8df36cfd59ae1b9c49f34e992

        SHA1

        070f51ada07727c2d1019e264943a9ff0ebceee3

        SHA256

        b9ed8c6e807142f860b6e4d6817b80b6c9a892fd7b166b82224a00c15e21e6d7

        SHA512

        cf01f70afacbb0e3106a9068e877001dc2d1d3f84ec63cb4655f43896d659acd3aab0150aeac566e5f30461d243ad004cbb2e81794570bf6a8cacdc9246a06ec

      • C:\Windows\System32\VSSVC.exe

        Filesize

        2.0MB

        MD5

        fb22ee548bd7b291efa7afbc72eb01e5

        SHA1

        f255b8e9aaa9632d5f365ee437f3ace3c155a3a3

        SHA256

        e306a3955c5943f205bc28866c8453a35b802451f7c90a1eb812f3474b01db17

        SHA512

        8991901d857b51a34bf8ed0e7eb99aa8052d8e5e8e344fafa9d59ccc403e3882ac3f26a1e34069d30bf69f3ab114a95201f1955e90d11d3e12ff6162e58e04cf

      • C:\Windows\System32\alg.exe

        Filesize

        1.3MB

        MD5

        1380bf8bd7a20e52e8d817f0662023ea

        SHA1

        bfa1494faf397b13fbd7f9dd0e060cf82df88d21

        SHA256

        349c55af19d4ab0ff886e2a8af84aac2b4b19f5f88de5552075cae51fdb4fa4a

        SHA512

        e120a63d07b106fa587cf3c565c92fbc8d70f27b287ef386543549df88de462c87d666678e3221e2879e28850c47305c7e00329c6735c21c1e9a7e55a1065d8e

      • C:\Windows\System32\msdtc.exe

        Filesize

        1.3MB

        MD5

        74ffeb444959f41c0d65e045f10f4cc9

        SHA1

        2f30c9454513374575abb2ffb62dd1e91f45a976

        SHA256

        232f5d9408922a6469c1b605b599777061165d52007afe80c6272c911b795263

        SHA512

        f948847ebc4d418c0bdfe4536e98f3b5853dc0cff96b26be836436a3b2e19ae68309e07fe792201375dae9ff7d5130ba8bec11ff24d5f4b5efdb8b86f17aefca

      • C:\Windows\System32\snmptrap.exe

        Filesize

        1.2MB

        MD5

        c0134fa64ae6b1507df2c7809d0cb7a5

        SHA1

        5bb8736dfa6a4fbc0a94731d2f9f09e9c6c30caf

        SHA256

        1aea9686e53a7e819cdf9bb83330163df322fa8bb0e38ccbcfaf774340299e63

        SHA512

        c207a2ed1f2dc54ad5b1d633f3d5ced0b137b44a16d967787375030ad2246a0a9689b3988c3c50c750ebba5047e1ace324490c034b05dbadce266de2b7590680

      • C:\Windows\System32\vds.exe

        Filesize

        1.3MB

        MD5

        913e0b1178c877007d1eb826490ba08f

        SHA1

        7ead1999267b0e8967ec2ed63a1f69881cb641be

        SHA256

        2124a6443631d80b2858dedcb5c70814203c3a0e55e08244cba3b9c565ceb9d2

        SHA512

        76555fbbe5283189242c0e91ad19bbff98d2e088146330bfec9070a9872ccdb364752eb9724c9146dd8748f36ba3aa793839e708a2b8f6696c1a15b65cdc1d57

      • C:\Windows\System32\wbem\WmiApSrv.exe

        Filesize

        1.4MB

        MD5

        fb2ac637a53e57cec3172ec76a8a7fae

        SHA1

        de4895bd52bcaace215b43d0442ec201c0b3a262

        SHA256

        a5b70387b41a94fd452f0bba4295887eec0b515f5819fff28cbed276b12cc898

        SHA512

        f7b8a9c5d99565ab26eb780422ad577dcbc1fea8689778a13b1a0bf53a1710f5efc2321ed92f3dba17c7e13849023d525033779274d5a71b16f976ad7acba0c9

      • C:\Windows\System32\wbengine.exe

        Filesize

        2.1MB

        MD5

        04c6f96b59d9e8e40bfafa958362a865

        SHA1

        61789923a7987adc574cb1a4984cb258f0bf656c

        SHA256

        080e7994b0f876c6dd1abc081fd279416d60bd0c019a42d6f88f2a155a1d8d47

        SHA512

        2e952b476ceb50571645df350a73b8cd121f3a98004ab8ac56670ab7150dff957cbb0811f59314355268fd50c4ae6aef7cc0a876391ee88e548f0e9ffea51aa0

      • C:\Windows\system32\AppVClient.exe

        Filesize

        1.3MB

        MD5

        dff74d738db5e063d393637113476ad5

        SHA1

        88e79b082ba623ecc0b023e4f7c17823927b02e4

        SHA256

        6c7929c2f4188fffe0865b19413ef73a13506d049a287a01a85e66eddb49cd57

        SHA512

        83645fee5cd2b32a32a788ed7e60db796377a652ad455706605cd7e24af046d422138f971054b2a3dbfe32d9c7dc1cc310dfdd67f10f651d735b74ceb7bcbd27

      • C:\Windows\system32\SgrmBroker.exe

        Filesize

        1.5MB

        MD5

        833e5fefd975558252764d6bb87b2790

        SHA1

        06e1662f20545722497f0d559fa14fd92f8fd1f6

        SHA256

        2870d0509bd96974d3d86e5d8a80e707c678962ebdb8e0e7974606d4d25949dd

        SHA512

        cf7caabd719f85e4c5d8f51122e6a5a53eeb9c1eb5162d2bc21e515284021c76076653b8aea9a83ef59a07dcfeb4c5b9e1146af8dc75fd3fadaf75f1ef92be22

      • C:\Windows\system32\msiexec.exe

        Filesize

        1.2MB

        MD5

        e94bd151d6f0e71f804f48f382124a6e

        SHA1

        704a46d1a51be50471f20734b26d888cea1c6147

        SHA256

        9ad943a26638e6fa6ee7d71ba29ca71f6ecf90c98a8b876737afb5934e2dc531

        SHA512

        9ba533d98a21d8f650df3131ee2eeb9da9c7a07b8b33b9ccbc1820d881c307a0fbca3c64e4f7bb1a17c8d76d0fa319d12714e2bce72ac25ec9fabc791da18b30

      • memory/720-6-0x0000000000B70000-0x0000000000BD7000-memory.dmp

        Filesize

        412KB

      • memory/720-87-0x0000000000400000-0x00000000006C3000-memory.dmp

        Filesize

        2.8MB

      • memory/720-1-0x0000000000B70000-0x0000000000BD7000-memory.dmp

        Filesize

        412KB

      • memory/720-0-0x0000000000400000-0x00000000006C3000-memory.dmp

        Filesize

        2.8MB

      • memory/1900-214-0x0000000140000000-0x000000014020E000-memory.dmp

        Filesize

        2.1MB

      • memory/1900-112-0x0000000140000000-0x000000014020E000-memory.dmp

        Filesize

        2.1MB

      • memory/2024-247-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/2024-577-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/2232-129-0x0000000140000000-0x00000001401D4000-memory.dmp

        Filesize

        1.8MB

      • memory/2232-250-0x0000000140000000-0x00000001401D4000-memory.dmp

        Filesize

        1.8MB

      • memory/2348-566-0x0000000140000000-0x0000000140241000-memory.dmp

        Filesize

        2.3MB

      • memory/2348-185-0x0000000140000000-0x0000000140241000-memory.dmp

        Filesize

        2.3MB

      • memory/2412-227-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/2412-576-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/2520-196-0x0000000140000000-0x0000000140221000-memory.dmp

        Filesize

        2.1MB

      • memory/2520-574-0x0000000140000000-0x0000000140221000-memory.dmp

        Filesize

        2.1MB

      • memory/2832-140-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/2832-569-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/2832-271-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/2876-88-0x0000000140000000-0x00000001401F8000-memory.dmp

        Filesize

        2.0MB

      • memory/2876-199-0x0000000140000000-0x00000001401F8000-memory.dmp

        Filesize

        2.0MB

      • memory/2876-89-0x0000000000D40000-0x0000000000DA0000-memory.dmp

        Filesize

        384KB

      • memory/3012-69-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/3012-61-0x00000000001A0000-0x0000000000200000-memory.dmp

        Filesize

        384KB

      • memory/3012-67-0x00000000001A0000-0x0000000000200000-memory.dmp

        Filesize

        384KB

      • memory/3012-182-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/3080-226-0x0000000140000000-0x00000001401EA000-memory.dmp

        Filesize

        1.9MB

      • memory/3080-115-0x0000000140000000-0x00000001401EA000-memory.dmp

        Filesize

        1.9MB

      • memory/3132-79-0x0000000000CD0000-0x0000000000D30000-memory.dmp

        Filesize

        384KB

      • memory/3132-84-0x0000000140000000-0x000000014020E000-memory.dmp

        Filesize

        2.1MB

      • memory/3132-82-0x0000000000CD0000-0x0000000000D30000-memory.dmp

        Filesize

        384KB

      • memory/3132-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

        Filesize

        384KB

      • memory/3132-78-0x0000000140000000-0x000000014020E000-memory.dmp

        Filesize

        2.1MB

      • memory/3492-48-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/3492-46-0x0000000000540000-0x00000000005A0000-memory.dmp

        Filesize

        384KB

      • memory/3492-44-0x0000000000540000-0x00000000005A0000-memory.dmp

        Filesize

        384KB

      • memory/3492-35-0x0000000000540000-0x00000000005A0000-memory.dmp

        Filesize

        384KB

      • memory/3492-43-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/3732-126-0x0000000000400000-0x00000000005D6000-memory.dmp

        Filesize

        1.8MB

      • memory/3732-238-0x0000000000400000-0x00000000005D6000-memory.dmp

        Filesize

        1.8MB

      • memory/3792-581-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/3792-272-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/3860-158-0x0000000140000000-0x00000001401D5000-memory.dmp

        Filesize

        1.8MB

      • memory/3860-393-0x0000000140000000-0x00000001401D5000-memory.dmp

        Filesize

        1.8MB

      • memory/4076-223-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/4076-575-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/4224-172-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/4224-464-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/4488-56-0x0000000000C90000-0x0000000000CF0000-memory.dmp

        Filesize

        384KB

      • memory/4488-163-0x0000000140000000-0x000000014024B000-memory.dmp

        Filesize

        2.3MB

      • memory/4488-50-0x0000000000C90000-0x0000000000CF0000-memory.dmp

        Filesize

        384KB

      • memory/4488-58-0x0000000140000000-0x000000014024B000-memory.dmp

        Filesize

        2.3MB

      • memory/4632-33-0x0000000140000000-0x00000001401E8000-memory.dmp

        Filesize

        1.9MB

      • memory/4632-24-0x0000000000680000-0x00000000006E0000-memory.dmp

        Filesize

        384KB

      • memory/4632-30-0x0000000000680000-0x00000000006E0000-memory.dmp

        Filesize

        384KB

      • memory/4648-212-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/4648-200-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/4880-251-0x0000000140000000-0x0000000140205000-memory.dmp

        Filesize

        2.0MB

      • memory/4880-580-0x0000000140000000-0x0000000140205000-memory.dmp

        Filesize

        2.0MB

      • memory/4928-111-0x0000000140000000-0x00000001401E9000-memory.dmp

        Filesize

        1.9MB

      • memory/4928-11-0x00000000006F0000-0x0000000000750000-memory.dmp

        Filesize

        384KB

      • memory/4928-17-0x00000000006F0000-0x0000000000750000-memory.dmp

        Filesize

        384KB

      • memory/4928-19-0x0000000140000000-0x00000001401E9000-memory.dmp

        Filesize

        1.9MB