Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 22:24

General

  • Target

    2024-11-08_88574adf6b22687ed4b867a60634bed8_bkransomware.exe

  • Size

    1.8MB

  • MD5

    88574adf6b22687ed4b867a60634bed8

  • SHA1

    36879e28e86a180301967aa746e31babaec128b8

  • SHA256

    d4f61d2c92281ea792f9875f829c0f96f834f2f694830ffc7e5fd0d85b0a8a25

  • SHA512

    fe2f440d92a19b502f64367e0d09f70daa63c8ccb0cd6e786ee9e89757901561d891e653c59a4b79e4ab3b60e6d81bf6e2d58ccac761a303df2192e3249ab977

  • SSDEEP

    49152:KE19+ApwXk1QE1RzsEQPaxHNOkQ/qoLEw:P93wXmoKqqo4w

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-08_88574adf6b22687ed4b867a60634bed8_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-08_88574adf6b22687ed4b867a60634bed8_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4488
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4548
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3184
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3264
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2896
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1964
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1464
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3696
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:516
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1688
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3792
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1232
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4780
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4380
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3188
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2192
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4272
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:5036
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1504
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2964
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4980
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1316
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5012
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:540

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

              Filesize

              2.1MB

              MD5

              b1d1d997a1d3755b2ea946449620c307

              SHA1

              71a290d8fdb21d67ab378a406acc5086482fc990

              SHA256

              1a94c389c80b1032a5008119a21a003da8cc72274e9e655d884f58259496a7f9

              SHA512

              150a9d25a075008e80c9f7ee9dde236d5e64a906a388655551a71143e17589dc77c70bad4c364058ca4662fff36e0566de3555afc1e5c7ccc0c5b0b138f87b15

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              1.4MB

              MD5

              01e8cf4c740da327c992b95edf6391aa

              SHA1

              d0cad6960a41f64311e1aa5d0b4ea2301cd48c30

              SHA256

              8eab6498711b4ebc75cae4bccec4be147f85b78969a90c17da851de2d5690d09

              SHA512

              f216f63969c326f6bc90636ae30e4ee08ebe2dc28dd0c29fb72b7addffaf407c86df5b7e7f8860a0c64722bb6c011a94ff239e78ef58e07df6daf5ec51957155

            • C:\Program Files\7-Zip\7z.exe

              Filesize

              1.7MB

              MD5

              014f4ef52971aa001936904e261b06b5

              SHA1

              3d375fa0e312f578f6f84827122457d74751c8e5

              SHA256

              4634d8123c58f87b79afc81fd1925a2be500d2bbfe1695f0abea37819edda697

              SHA512

              5cd14a87f41d80e8c610d2d93e9957453a29428a177392b153411c1b3b142df8d7b934eb32656d1c2e537c65ac8e88d17f265e866fbf35f95c7f259267aabe0e

            • C:\Program Files\7-Zip\7zFM.exe

              Filesize

              1.5MB

              MD5

              815f03497e76a42d181586b25028e9ab

              SHA1

              6a4ab0b8cc917fa265c375d4c499ba42e7511768

              SHA256

              456b63afdfdcd0e5766e3a3f831c882f347a748d8421b4076bf878de1ba89315

              SHA512

              5ed437e3aa8e451d33f2cdc0f968b4a7088a7d78f95251d63c7d5970800234ffe0ff52f1e56fdcbe23929ad4b6fe07c4e4c702b60e903698109fe742de2424f2

            • C:\Program Files\7-Zip\7zG.exe

              Filesize

              1.2MB

              MD5

              ebee09e2a0bd4ad6560364fe255b7c24

              SHA1

              fa6e380b833ecca0f393591503339a36e39180a7

              SHA256

              db13851352d904262cf731d9dbd315ab5de60757d2154b062a49c33b2aada6ca

              SHA512

              984c5ba524b7e5cf4a7eb6cbc400864505226bb3d480ef7c3365478e36574f833147a219ac6f2f2eb47b1beb1474a179acf199af080b4abfb5ac69e558dd9127

            • C:\Program Files\7-Zip\Uninstall.exe

              Filesize

              1.2MB

              MD5

              9f3d7e718fe994a98e92d5cd682cc13c

              SHA1

              010a6fcafce75ff179d62f8453e7e257fa07a661

              SHA256

              066727b0cc98d0ce5276507baa0cb37947cea81df5052028bba1684a6aebf496

              SHA512

              a2206fce8a96c8089c533e06f1fb444fdd4e29236c666b3707b8ca8372a2a33bac629265c96bd4773af1521a5ef9da105ad1fadd182ceb85dfba259d0a94cd30

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

              Filesize

              1.4MB

              MD5

              edcda6e48ce98463d0f414ba9a8c0f60

              SHA1

              459fb3fa3a94e06d3fdd06ea3b24016f814464f5

              SHA256

              9775184adca6fce0666915cc46c91577fd7eb6b6f69047eb9857dc128eda7b58

              SHA512

              2f7fa9d4decc630a3ad956b823a1a535c3f64d65036869d5185b8af22ee5abcdc234dd846ae82fe6f85e525658cde42b3664d029a15bce7175d8f1ff54811485

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

              Filesize

              4.6MB

              MD5

              923b395efacc87739acd1402df8ad9f4

              SHA1

              36e268c1b15aa6f71b926f196935fe702a1edd43

              SHA256

              f6373bf90279119d4c83cf98db395b3376e0e7146fe9abe2c5659ab39be521c4

              SHA512

              ae713030005595a8ca018fdb2b15ab8eb51ef85c30b590e964cc73f61c41383cd9fab1131b8763c0ae0cbc60a01cdeda3d164add1b3a0bffbdacf03f473d2b77

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

              Filesize

              1.5MB

              MD5

              926b70f78cc1caa2f7273503f0079757

              SHA1

              2a022bca7822bc21cdb245b5b546242bf3ef989d

              SHA256

              2ef49256bb874103961718f32d3ba6728875391f78a296ff158d166a202bb62b

              SHA512

              44838e8311f88dc092ea39b352c52ddae8685f4ab7095c4df56f0a94ffedd50e81fe75b1cf1ab1ed03c7831d07f6b9fe6ab01b0ed9d26a3b5b2306dd1fdde39b

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

              Filesize

              24.0MB

              MD5

              bea1eccfe0c89664182d2d68502932b3

              SHA1

              85d38e4305c81275ef8191621ebede944f10bb0c

              SHA256

              6456aec97200bed30b7293bb506987d1a98bca92c261cc20e18f6f9298046be9

              SHA512

              37f3b461f1ad9cbef1f7d01b678f57d66515c8def15d74a846c93f72c3925cee63af663e38dd3634c07be943ccf765ed5ecd209567bb41d36c3d87b04424f2b7

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

              Filesize

              2.7MB

              MD5

              4534cdde6539c1706198261db19a05f7

              SHA1

              99e56febeae8c5952e3042078a2f982f298a02e4

              SHA256

              7bf9db887bbea616570bf0dc0d36280b27b33dc6bc511d47882dadbd1eee724c

              SHA512

              53c8d544cb2c683bc5a9373a5280e52c8e1ccc5eb2a175196fddfc13af9277064ae26641aaec911a843e4f1e0444bb8938b1bd45179bc01ff12febed82ae148a

            • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

              Filesize

              1.1MB

              MD5

              e9394d122460b018f0e3d76f856a78ae

              SHA1

              633c07d3a3c301bd88b3afd3d6b7badfb85927a5

              SHA256

              00e74702e07b8080aa1845a81539342184a886ec8e4043747130a410c4bfcd5b

              SHA512

              55ae5ee69fcce34b77a0f1e62cf536756fb8213439d260148957d42a225ea3e30f040472afe395f316eeae679f72834000d7648945ddd0a31fa720999d520f40

            • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              1.4MB

              MD5

              51069605bc27a85faf941d5ec7e1b8d1

              SHA1

              f1281192c83e312f7f917c261d3f661b360c8996

              SHA256

              869d347cb5a839e837235b8e5929c8230a2325e5542a18a19a53e7e550610191

              SHA512

              8ded9ea5e30f017ca1289d2c5fda299e393aa7a28a42d32a7a39616b405fabf3a785977a616b31826f82ea96db7e91ec0bc277ffe095eea4b0b0baec07eeec2d

            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

              Filesize

              1.2MB

              MD5

              645bef3a09c46b8397a9892486a5a4e2

              SHA1

              e7409c95f0c01b01da300bed545559d3d56e3ade

              SHA256

              4ac4766e5f99d73aeeeede63c30524a68dea383d3476a0c3aedd20c871fe80d4

              SHA512

              7a470a325dc0babbe5edad87eea940f72d195e9ccef9ded9847e18020d221f630878958a35522d78690548b924c363dd7be06b7b8fc6856a67300aa70307fa69

            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

              Filesize

              4.6MB

              MD5

              d38c9a7d0c76de22b8d42a66e467743a

              SHA1

              b494bdaec4461587d06ab6de1b180a05c81f2dcf

              SHA256

              4c3596f91e9d4968f50dd2384d381965f63399755c002b488e08b4ac56739d1a

              SHA512

              df6688754f36b828008a659b5dc11cc9eb36aaeddf33731acb638aa6d20d84c153c7dc248c8fd265e8af72e7bbdfc6c998333de8236138082fb6e001f364ddf3

            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

              Filesize

              4.6MB

              MD5

              81c9da9033baafbbd9c6e5bbfb7ece5c

              SHA1

              30985e910bc8169f242588156b1b8c57d9c5572e

              SHA256

              6fb083fbdb1774019110778e084e4dcb7bfbf44a305ffcd977d1c0163cdaf157

              SHA512

              c61718db7843b73e699233c41f95f56eb22b331a76482c66cf9b608eb9f3402fdf2dd9802316cd9b7c580b31b2d99aed5f96bdb371c414b3a86ce47c1e9330be

            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

              Filesize

              1.9MB

              MD5

              1b660308737a80ed27bbe5cfca494a9c

              SHA1

              acd38eda2e188b2977ffbd1a3d6f407f1c70180c

              SHA256

              4fd8368fbdacae1c28e0f8dabb566c2559934a100962a0bf58232b84d4e37a8e

              SHA512

              1d689f3ed391557c9c7a49f0b9ba030c24b1896ca4d253e636708212bd097fe519c7b9885e024aeafa0d03db295cf9afab386f4dec0671b3dc89685e25c72476

            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

              Filesize

              2.1MB

              MD5

              2d509f9ab1cdc7eeb51524a6e665a7e2

              SHA1

              06cea425093bd85334be7a9a1bf1b3442dbf6240

              SHA256

              0ba8e5bc563e96c962b56b4b1b971aebb272292a563e85764e5852bd00c9bb44

              SHA512

              84b55eb790107652920ef5cf721dffd067647c177627bccd9fb43899b71fc01a0b1c11895d1f052e32d8e6443bfc16d3f59a6aa3be08cef92f679b8ca31d4eb4

            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

              Filesize

              1.8MB

              MD5

              5a1fcc8a7985f1c5b17a9639ee5f31b1

              SHA1

              6f3e0fb507c16dcb4151c65e788d5aa979feccf4

              SHA256

              8a9b5e6beecf367c42f9a00d2b72b07c94dfbab6e416d013d240e9c317b13682

              SHA512

              85ad11d80d969b61864526ca11558ab22bf8eb6d8bbcabf7bff58869451e51b2a2c366fa128dce8d10eb9836cf0a8201e3f32a059006eba595bd3c5a9a7d1f14

            • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

              Filesize

              1.6MB

              MD5

              9089de033e5b86d9ea75131809e135e2

              SHA1

              30d2ba64785a30db57b8e19834ead76378fc7ad2

              SHA256

              5e1711e426ca2fcdf2860f0037bbfbd555b483feea8c5c3dcafcc3d4f852eb0d

              SHA512

              2048c8a8735d64cfa72d9761ed366fa82047dc88e5dea463310f024c34d59dd1ad784d58ec4a0ed6fe851afad53af423662fd9211445e839a3e287f6aa0abec3

            • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

              Filesize

              1.2MB

              MD5

              e53039660aa420e936e5f5c29750c73e

              SHA1

              843e3287a13ee0047da0ecab641482a9dce003c6

              SHA256

              e012c508954eceab99653b1421c79fc1843b200df8c4311dbd103013b3dd354a

              SHA512

              3c6e861484a5652b69d4079b87dcf2d16c3301cdd10f9953863c2637deceed8e4e0c013b7a955ad2a30a43e3d54a2b03641ad03cf1afbab1c617f5afbb4f92d7

            • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

              Filesize

              1.2MB

              MD5

              1d3da7299759a19aa408bf65eb0285b7

              SHA1

              67b09554421d0e2a80b9a9b137410ad61d4957f5

              SHA256

              73507b1a9b385bdc2e824c17f95fa84679c5304dc970b24a03b645ba1f5d1b25

              SHA512

              953c248a996f102010f880d3ecfe2361fc7bb9b03f935cab3a15b6496d69583e90dc6118ca9f5a026bc36408ed5d1b7dc8813f8913afe07a8f5ddff0fb177934

            • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

              Filesize

              1.2MB

              MD5

              422685df504376b3398bdbbd74aa35e7

              SHA1

              26ed71bc92227a75e06a23db364fd8c4e25b39ae

              SHA256

              aa5e5be7e3b411be5eaf1996f1bffe9c35c72a0a7996e1ba418397bcb47f1322

              SHA512

              477d3f1df4e67ba74dbc32cf391850b4d790be15cd6250e725188009b73120db48be02f707dd0e6ed89ed3e40bb3f5a2ca241ab0b76be36c754d77dac6ba1f18

            • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

              Filesize

              1.2MB

              MD5

              973b1586072b42fa9c3c1c1b42bbbba8

              SHA1

              300b1312da914f9ac65559b02342e28f1b69d988

              SHA256

              e71052693c91a9339b7da1b4b0f13b30ca52b8420ab6394fdd766da55c50143b

              SHA512

              d2544644ae76ebbcb801862c637a3e4d856bec80417f5b1b0c80698906dc53626ea77696888c7c7cc537e520747f37e311095c589ffa15c94de0d4a5914f39f1

            • C:\Program Files\Java\jdk-1.8\bin\jar.exe

              Filesize

              1.2MB

              MD5

              65290a78363d26241a5cc95e2401591b

              SHA1

              1645dabded3721c1f172267e4f5945703d3d8e9d

              SHA256

              95ed755c998253df4ddfec00bf102193c30eeba81de5ccc056f5786f56ed19d4

              SHA512

              381e34eba184975cf13b4e9c07936810800c9c267430346c38f7c569d898db3f941ed301d23cff34ca2a724643a8c9898a720e4b0aefe8151749777321bd0b73

            • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

              Filesize

              1.2MB

              MD5

              4defa31b6862b471910bd3ad77388b86

              SHA1

              e3c44db56e7cde457c74cb9c6f199d01b92b4b69

              SHA256

              bfb06fb63bd2925ae0e3b3c734b68890ccdc1c99a6d1eb339c3592db29cedf25

              SHA512

              b60acdc509007fe6ad2eac53d0f9e43f8b94573f898163b97209cb102eb368995e6988ec8fdddcc7f24e0fc295e3ec9320d7e92b4db0c5ce5daf912f601068d2

            • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

              Filesize

              1.2MB

              MD5

              0d752027ed48230126ac2fdc54d708eb

              SHA1

              9d072d83fd0422713af218e19636dfe86cda4e6e

              SHA256

              e4f9824437d793f0e83a91c942b4429de77202cb0f82c3b2719ceca97fa57ea7

              SHA512

              c99a83540d02634d7fd743a057042a8f2ecb4ddb327560a94e0beca1acf6f2c1a3e7e5ff6826534eaef31c4d1b6a55d626d823465cf15c85a363326a269b8c37

            • C:\Program Files\Java\jdk-1.8\bin\java.exe

              Filesize

              1.4MB

              MD5

              92024e63def6303b8e1d6b4aaa1e8e5b

              SHA1

              4ec150a1edeab06d23f03b151ce30d289004e862

              SHA256

              50105b2b1de4b8d2b370f0fd3d77487a02baa9cd60b9dc6cbfbd4c9d3eba550e

              SHA512

              9e3182c0b37bcf7b701db4b13f98eefe985f0c535faa7c316e318e54c7edb7e34f8c15a13d2af86910a12bde94dcf8199cd9b4cd5d4db13775e91446da7e4796

            • C:\Program Files\Java\jdk-1.8\bin\javac.exe

              Filesize

              1.2MB

              MD5

              65309008f8c97cd5ec0cb0c2dab31096

              SHA1

              8ae069b5bdcfc2b7d99d14e9b07c211cfbb7a9cd

              SHA256

              28335918e18479c82fb0deba6e15886cf4285c5ed36d14616cf77b7db1fdb044

              SHA512

              9d1042395d4f729dabab2f23ab90acc1616db362c4ab0a2badbd001c7670d472ca438af636b10f72541b0f2185f5f70b0b6fe90314491c5208287a9cd4028ccd

            • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

              Filesize

              1.2MB

              MD5

              bef0252df08ba0fbeb80381bdf724b53

              SHA1

              598274404c94f9a5058072c1245850ca82661653

              SHA256

              b0470c9b7cb17bc6d0a9b063d3e7c1fd36a3da062cbb338c6939f016622b805d

              SHA512

              526edb987654d2304e5529a9528c7bd02e4509abee4d32ca1d0119106969d0f9a4a0413c0619ca49950370081c6beb8d69f398a0669756c03452467b027da45f

            • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

              Filesize

              1.3MB

              MD5

              f65a60f5d1f606e889140d753c4733a2

              SHA1

              ada397de63e24635f33386b29e04321207a07789

              SHA256

              d3f7421fc3d01c4692d273ab453bc09ae1b237ddaa868967e1687ed64a781408

              SHA512

              6778ae39a1cedee13805de98fc25fd85d57fa30d44557954ed3959b16dbdcaaca503aa544db083b59e2b5dc4288d02d012192d31e0d7567a4a328986d1e09efa

            • C:\Program Files\Java\jdk-1.8\bin\javah.exe

              Filesize

              1.2MB

              MD5

              37eddb839b58a3b9f35daa2ad9495ad1

              SHA1

              53076ee225daa70b036daa58b4acdf06b2c48beb

              SHA256

              af1b60361e1afa5c32039b8c08a8863f54460f165040ecdcae531dcd8b0e9e2a

              SHA512

              4aedb04e706a39555d046acb3e402f2a86f98c811f3fd700aee7e7fe5c6a83815deff6d5e18930be541163ca73877ea02ec339b951609606283a6cb0584b441e

            • C:\Program Files\Java\jdk-1.8\bin\javap.exe

              Filesize

              1.2MB

              MD5

              68e9397190a872f923013a2f38f065c1

              SHA1

              0311d1fda74ec984231aee233da1cd1f30d085ed

              SHA256

              006be1e2fc7fc60f0aeb4db077e7deb4f762881aeec644ba0749089c757de861

              SHA512

              c63f430da041f636acd12d2af4f61e07d0a14346f30bc1ce40bd502dfddca6c2d3a841bba210a413678002d7c517e6512e7c6820d279d4e08bf516d7ace8457c

            • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

              Filesize

              1.3MB

              MD5

              767aa2311005ce5b5025b3807d9b409a

              SHA1

              49436b98cc1f7efe197bf1a8c38d6bf86a7b2edd

              SHA256

              045b303b955c863284e8c93de74677ebd666c02bff7965d0176f1a4825adcb3c

              SHA512

              15a0844c8c9192b742ebb3a684d61f300f95600be97ef97aedf341b3793c5b3bb70c82a9ba083a96f0150e04b40135884d3f6875f445d6c97e2c0940e3bac4c9

            • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

              Filesize

              1.4MB

              MD5

              d4cbeeeee7e87e42b90d2e075acda88a

              SHA1

              6095c8f2dd722449465e2ee07c89b012b8fc1cbf

              SHA256

              9b92217152155540ffb07a4c321344385eac2c23ea7c3091b98398655a4d4376

              SHA512

              880006fa16f44fb83ca7942402a91e23f72ed9a84610866849d6744ab01ad83ff0b869b6cba96a54bf9149d2d990aa15cdbbbf0b1f022d27a85cde0ea263c419

            • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

              Filesize

              1.6MB

              MD5

              2242502f550c3f6b8da8cd8f96a27370

              SHA1

              63363cb46e775dec3b32026f4825a40a3320b342

              SHA256

              02b61b5a050732fc5da772e14baed9228a1020a18dc9cd9c91d7f7a205c29483

              SHA512

              39e7fe5e2416593d64a472ad26456e3331c6a07be9a62922a670ed5f1e27dc3bde58607d49cb0c6f71b9d23ce1081a709f7adfa026ad587831348d02a40fa19c

            • C:\Program Files\Windows Media Player\wmpnetwk.exe

              Filesize

              1.5MB

              MD5

              4b62093737ad3e26c118d6987617ac78

              SHA1

              4ef56b71f6fe6120439b82c44a719506a5266ff7

              SHA256

              72b49167b796ac5504e66ad1739ffc2945affce62bc9c7b683281ec450459d84

              SHA512

              00fc3dcf25c9df6143a28cdde62d64ea4e539b5909833c808272d33d67e733e6dc898f792c7c4169fc7b6ca0cd76a0f11c531c06151e09e28ec0b9b098a9da41

            • C:\Program Files\dotnet\dotnet.exe

              Filesize

              1.3MB

              MD5

              722595fc855570f751c2b6f949c47d99

              SHA1

              ce8844eacf26c9a6ce6f730ddb1ff2cbe299fc67

              SHA256

              717d31028e2dea7e94c9f8a7001460953b3423580d28b30574640debbb679374

              SHA512

              a8b12ac117c3e6ac92ee5028d2e78b01a26f2fe5cd767d69240af618be215a33918d28268980e8025f01d7abfbe3727291b77b0e0dac0db12bdff5b10a9e2d6a

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              1.2MB

              MD5

              aa9ccf54fdf49dae259483ed5f1bf6c0

              SHA1

              62338488f895462cf9746cafa8d32fe54f8e53b4

              SHA256

              fe80c9097a373d451b8962754c67e6a8b4eb19058c41779bf59ba0894700ebd7

              SHA512

              d315000400c83368626316c309668b96237516b17cfd166e51cf75653376a1bcf779889ad3e9d4d5bc1dbc20a18411f15d020b3bba6275d9531b447d4011d5e1

            • C:\Windows\System32\AgentService.exe

              Filesize

              1.7MB

              MD5

              ceb2a33e8586d9b06e43d7d93be76d3d

              SHA1

              ee40f1e6da33ecb51b10c3b27880f01f59079e2f

              SHA256

              41daa463cdb8da80b11dea3669ae2888d1df8d89e555ac27a4079930cbdda3dc

              SHA512

              c30e0dcfdcd5292b136f2fad322a4f860b3cc60d2ba197043fe18c7488d9a35aeb73d01b59a612bd9b00de70aa25c68874aa20341dbfa797522e2f1140ffb6d6

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

              Filesize

              1.2MB

              MD5

              a14ed59f314599486cecfde3c4c43a72

              SHA1

              d7b9f1bf94dd0a69403f91dfab5ab377993c23d9

              SHA256

              a93826e7838f924ac5814ac2b35ef25187420d8ac438e1670224db313827126a

              SHA512

              90a79784580e6b23a3891294e0802ae651e708a0b21aafcfb04f7e95f6e1651c52665ce2baa1eda7f2984d4135de1ce6ae60953d59a09b27b1737813b5a9178d

            • C:\Windows\System32\FXSSVC.exe

              Filesize

              1.2MB

              MD5

              c60fdc2471eebf1c050b867c2e1ba282

              SHA1

              063b474d6ecb1b9a85ef9d2cc2a3c18b64d7f0cc

              SHA256

              581347e7333eb2db55adde66abfd2f3c5c4cc8202e6d6421d0b4ef30cb43aab1

              SHA512

              a816e9560da333657995cb5fcc121bb5b4cdb2e9e75004dfee7e395fce4bdaa2768cc552499aa6bfe0c694c8ea6d0cbe70c8ce4894ccc20055bd3b830266d624

            • C:\Windows\System32\Locator.exe

              Filesize

              1.2MB

              MD5

              1696b48c5311b80d40552eaa7a43dcaf

              SHA1

              f49f62b4dc2b3d6d50cac30707994bfbc8154002

              SHA256

              04fc2025783c671f7b608a0d2eed6d36bc4c75846efa38892f2945eb3d5521c6

              SHA512

              9abc41fff8e05c436d8adccdd30cae71925b2add9ba506f833846fd676e1c305514f0e067c6f0725f3ec6a87f6f37d048e647fc7195c6ada95dd0cc0e35184d2

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              1.5MB

              MD5

              7b23ea4b5f3684a97b2e4ba073d9c7ef

              SHA1

              e5ddbc16242cb3c66a052d9613b13b1f29a82def

              SHA256

              78d9464cf03caa19548b5886e03bb35685e1fe2699282978c913b7226e10ed7d

              SHA512

              06f841a21dd984c3bb81312dc1aca3c99415a0aa74ed6a782eccd3a2a3a26935d1118ba115dd01aeeaee67e2cee1420c9ccda194593e5419c6aeb5743381a89b

            • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

              Filesize

              1.2MB

              MD5

              a1eb2a47ebb1c0d0a9dcec4f244a4410

              SHA1

              524d9f104dbdec4660e9ea8c252c726c46ef061e

              SHA256

              a3773974bd172f0d708c92bb89241d2f3e6c39957ef573ed39e389473cd5349f

              SHA512

              afb39ef0f09bfae33e7dfcfa901c826d0483cca8fcbf2316e4f7a257b5c22a244f3e35f4bdcb354d1878316b83af4166b097de1e088e263557ed203719f16aa2

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.4MB

              MD5

              a999f846b3f8d2a2842d66f11fe3097a

              SHA1

              53d1b8380cc6f3cd594e98c5438d70940b97bd03

              SHA256

              fa8cede6b8315608a661da5805a934c89702c93edc081e95c64fb3111a96f2be

              SHA512

              99e2be37a14e04e9313b9d761cf7597ec2b60c51a288296d6c6b8460e08b64f05e391a522f54226775c3517b8c4b808a9380fa2700425aea5dbb1128d8eb70bd

            • C:\Windows\System32\SensorDataService.exe

              Filesize

              1.8MB

              MD5

              3557e4b076e935686cca44cfb8a23b71

              SHA1

              f9b9c80fb67e2f8ff975d0f605a489b6053880d0

              SHA256

              c6d86ac565df311201eff72943bee65800f6178035afafb8c09d279527d31ee6

              SHA512

              dd800bfe9671d0712ca619b4a4d1e0f07f0b9ebdfa9b60e963b67be878a7aae7a9a198572393a6b93245ac0d5c9a2fb790a2cb74f03dcb06c9c5b414b39d0114

            • C:\Windows\System32\Spectrum.exe

              Filesize

              1.4MB

              MD5

              f13e906bd8d3229732dcf0cd18f5d4e2

              SHA1

              ddb751ee6e0c3bfee6fbbb3bea4a5d59f3217e98

              SHA256

              d853d369cf99f4e9ec310716c42b07df441a3d071ce3e1f9d31929d524c12a11

              SHA512

              997d4317126feaccbeb3a0083c719695722835dc92139a39dc08ff57d5a958dbb3047ce1e10f36c251612d3021a32390be7fb159fd94e1ed3bda7eb6cd9a1187

            • C:\Windows\System32\TieringEngineService.exe

              Filesize

              1.5MB

              MD5

              522692903a879f84cd6b3b4a3630b5a5

              SHA1

              27108e5d5f192b47ffc09139103f5e0e62150348

              SHA256

              1d91c28f3a4803ac2758e6c8c451c7a5e2d42fe3f36878dcc920c641b595d4d4

              SHA512

              161ae46558bbd19cf7b079f72cb17082e88f9e4e9df8a8b9a0664d81f5a8363265d6e91e1e055dbf7bb7469685afe674c9cf82f6e73e189d38d05597274595a6

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.0MB

              MD5

              fdae79a552b7e0f747c11c40895befe6

              SHA1

              bda3b106e8331ce82c126e2cb75d87daba016c39

              SHA256

              8bc2c5489419bfbc9422490bc53d4784284491207ae86dbf55a69d9b9b6659fd

              SHA512

              a409da22687359eb7f4d11cc2bc4e70eded76fc0c0c49f484f434fbb48a1cfd0547dc79fa8bdd79bb7a9cfdf0ce2772bffd335361fdae45530b59d8b4b3b484a

            • C:\Windows\System32\alg.exe

              Filesize

              1.2MB

              MD5

              7ec1886ef6c6b006cbc4ec5805fcc6a0

              SHA1

              23e8df427cffbd1d64a3a1f44a050fc62f54bc1e

              SHA256

              782026e06290872065451229086497e4125c6a0cc971c55cfd8c6ddb4a3b77b4

              SHA512

              3f72e324a81f4d763ca49cb13f05d5149937cf07a5fc024f3fab6809f267bbc212bd5802fb531c9490bb12d683c1e28f36a524d7201a5274ff629c45d6b11c5f

            • C:\Windows\System32\msdtc.exe

              Filesize

              1.3MB

              MD5

              bd169d73ed06dc863e00621e47f77fba

              SHA1

              a608d9920759c2bc9f7fb9f75d8278ccdb669d80

              SHA256

              021c0ea5ad39cdfc17b7d75a8a058a97b07fe4cbd238af8afd64d9477085910b

              SHA512

              25a6e56202569e395c24247d43c8474c72bbc249493fa6d3a35489f52de69a61cb258eb14214c3ebd001f086065c45974c254c9c6a4b438abc84d77833ce5022

            • C:\Windows\System32\snmptrap.exe

              Filesize

              1.2MB

              MD5

              e8212c9191e15690aeb8214169f54b8e

              SHA1

              ae70e50fc3f264f5f35081116448cba05621c0f4

              SHA256

              e9c2234e812d95772b0715ee86600385249bf2045a69dc799ccb30998d81ef9c

              SHA512

              6c7bb719f99fd592d01df3e530d4985a20bbba1e97f9e52da5e2bdd68f8e244ac52674e5b2b8f9e70879736e72a622994220fd4ed640fba040c02d98133295db

            • C:\Windows\System32\vds.exe

              Filesize

              1.3MB

              MD5

              7e94f3c78b94885a33b18ecc9be42f56

              SHA1

              b8981b9e300e41b5e03f3382a9609158126a4a2c

              SHA256

              f22a79788e7084e0946b29bbedab29b845516ac0f5963232f57f7a45ddeb96ad

              SHA512

              2c4b598d654753883ea557440b9e0f23cbfb4a97dec54cda47938d4d0acb507a03bdbb7fe614824e2d7dec41e9ca4be38bbbda85ca7687d00f57e2bedbee8200

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              1.3MB

              MD5

              76be0f05db0b75b2937f71f9a1697f1b

              SHA1

              b71fbc28b9047b28c2209453ff1205fb76443f03

              SHA256

              b9f2cee7c4f71df52a66b8e5f5140603b65353230208ea494fc80b36377abc04

              SHA512

              ded008a4a56cf786b677a188ae82fa996bf868172d09a3a2b607a9831222da74f552c794426e4ab63009ff0090d6c2316f5981af2c5a9ae78a1f217034b1f44f

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.1MB

              MD5

              7977029e810f0f6609fa7d51ae5c2227

              SHA1

              f0720e6561de4e630d2252e151b163fda148196b

              SHA256

              c7e90823854f5ebff724ea1627a50c84777d53a2cb288855257af211247118ff

              SHA512

              60ced8a1b47681b844961ec0ec3d6854f21fb187aeb12226b086879fab5e317f0f2dff6eea4754967ed8168ac342bae48f3645ca32ab2d40ff864ff2e4f8d0c6

            • C:\Windows\system32\AppVClient.exe

              Filesize

              1.3MB

              MD5

              398052a6afa6b2b30a4bdac574c89e1d

              SHA1

              b7810c3a735f788ddca4e25d148c48fdd5c9956b

              SHA256

              be85fed067d6756a7c46dbd6bc6b02c8ece5dc4b18e7b78afc62fea9f482e7be

              SHA512

              23d33c482735eca6e018fa75736f9fc126be2a825f623236987676840b63d0b3f0a8e86c3d37d16a0703c3ef6b7aff5ca90be2ba8db5a337191aba65dc0cdcfc

            • C:\Windows\system32\SgrmBroker.exe

              Filesize

              1.4MB

              MD5

              d373b8e7c8df83de2ed021db5ddd2e8b

              SHA1

              18e2cd12b0fafd163f8c2578713a7d94c34a3b9a

              SHA256

              4edf39f77bf9d6684246345733722f21ffa041607d8f9ccc76de084913ef17a0

              SHA512

              6ebbcbe19210ad0d3095e3e5376e50fc6f157877d9ae04cf3d06bfb99c66e426b62e3181dcd14ee98a40aa64434125e7f03813c6b49f897031eb3cf7a3baa8ef

            • C:\Windows\system32\msiexec.exe

              Filesize

              1.2MB

              MD5

              fc07d549e854981a2acc5d78c45a58ac

              SHA1

              89378a31560443b6cef4a25f4dee72e9eafb0473

              SHA256

              cc59a5e573da03e09f092a20f87aea1ff59de24be5533671501e3a6a52e3e595

              SHA512

              90a11a13d4f41c969d099c94fc2e8626df64de3b8981a654f5be8f28fb245be2f9e994565e7f865e1abae74b35072a6bbadb2755e60d4eac4f9108fc5126629a

            • memory/516-102-0x0000000140000000-0x0000000140150000-memory.dmp

              Filesize

              1.3MB

            • memory/516-91-0x0000000000DA0000-0x0000000000E00000-memory.dmp

              Filesize

              384KB

            • memory/1016-277-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/1232-269-0x0000000000400000-0x000000000052E000-memory.dmp

              Filesize

              1.2MB

            • memory/1316-318-0x0000000140000000-0x000000014015D000-memory.dmp

              Filesize

              1.4MB

            • memory/1316-588-0x0000000140000000-0x000000014015D000-memory.dmp

              Filesize

              1.4MB

            • memory/1464-73-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/1464-70-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/1464-64-0x00000000001A0000-0x0000000000200000-memory.dmp

              Filesize

              384KB

            • memory/1464-463-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/1504-212-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/1688-113-0x0000000140000000-0x0000000140166000-memory.dmp

              Filesize

              1.4MB

            • memory/1688-502-0x0000000140000000-0x0000000140166000-memory.dmp

              Filesize

              1.4MB

            • memory/1964-59-0x0000000000C80000-0x0000000000CE0000-memory.dmp

              Filesize

              384KB

            • memory/1964-61-0x0000000140000000-0x0000000140234000-memory.dmp

              Filesize

              2.2MB

            • memory/1964-444-0x0000000140000000-0x0000000140234000-memory.dmp

              Filesize

              2.2MB

            • memory/1964-53-0x0000000000C80000-0x0000000000CE0000-memory.dmp

              Filesize

              384KB

            • memory/2192-274-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/2896-47-0x0000000000900000-0x0000000000960000-memory.dmp

              Filesize

              384KB

            • memory/2896-51-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/2896-49-0x0000000000900000-0x0000000000960000-memory.dmp

              Filesize

              384KB

            • memory/2896-39-0x0000000000900000-0x0000000000960000-memory.dmp

              Filesize

              384KB

            • memory/2896-38-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/2964-278-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/3184-35-0x00000000006C0000-0x0000000000720000-memory.dmp

              Filesize

              384KB

            • memory/3184-34-0x0000000140000000-0x0000000140140000-memory.dmp

              Filesize

              1.2MB

            • memory/3184-26-0x00000000006C0000-0x0000000000720000-memory.dmp

              Filesize

              384KB

            • memory/3184-137-0x0000000140000000-0x0000000140140000-memory.dmp

              Filesize

              1.2MB

            • memory/3188-271-0x0000000140000000-0x000000014012D000-memory.dmp

              Filesize

              1.2MB

            • memory/3696-87-0x00000000015E0000-0x0000000001640000-memory.dmp

              Filesize

              384KB

            • memory/3696-76-0x00000000015E0000-0x0000000001640000-memory.dmp

              Filesize

              384KB

            • memory/3696-89-0x0000000140000000-0x0000000140166000-memory.dmp

              Filesize

              1.4MB

            • memory/3696-82-0x00000000015E0000-0x0000000001640000-memory.dmp

              Filesize

              384KB

            • memory/3696-84-0x0000000140000000-0x0000000140166000-memory.dmp

              Filesize

              1.4MB

            • memory/3792-567-0x0000000140000000-0x0000000140142000-memory.dmp

              Filesize

              1.3MB

            • memory/3792-124-0x0000000140000000-0x0000000140142000-memory.dmp

              Filesize

              1.3MB

            • memory/4052-279-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4052-587-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/4272-276-0x0000000140000000-0x0000000140199000-memory.dmp

              Filesize

              1.6MB

            • memory/4380-586-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/4380-270-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/4488-1-0x0000000000CA0000-0x0000000000D06000-memory.dmp

              Filesize

              408KB

            • memory/4488-8-0x0000000000CA0000-0x0000000000D06000-memory.dmp

              Filesize

              408KB

            • memory/4488-0-0x0000000000400000-0x00000000005D9000-memory.dmp

              Filesize

              1.8MB

            • memory/4488-75-0x0000000000400000-0x00000000005D9000-memory.dmp

              Filesize

              1.8MB

            • memory/4548-18-0x0000000140000000-0x0000000140141000-memory.dmp

              Filesize

              1.3MB

            • memory/4548-101-0x0000000140000000-0x0000000140141000-memory.dmp

              Filesize

              1.3MB

            • memory/4548-19-0x0000000000720000-0x0000000000780000-memory.dmp

              Filesize

              384KB

            • memory/4548-12-0x0000000000720000-0x0000000000780000-memory.dmp

              Filesize

              384KB

            • memory/4548-20-0x0000000000720000-0x0000000000780000-memory.dmp

              Filesize

              384KB

            • memory/4780-320-0x0000000140000000-0x000000014012C000-memory.dmp

              Filesize

              1.2MB

            • memory/4824-319-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/4824-589-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/4980-316-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB