Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/07/2025, 05:56

General

  • Target

    2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe

  • Size

    1.1MB

  • MD5

    a15bcd1d72195004bf3786780a6f3bd0

  • SHA1

    c4fcab1ff4da190b05a671f0a2657922c4f8970c

  • SHA256

    29f98410c31c84c37a54ec2a292323e2e94cda86fec891c2ed5a5f99aa9b893c

  • SHA512

    c351e9ba27caf4bab1de3fbd5b93340e3f2aae46127366637e757206bc1ea62b788a54e0501ba5c5d4fc8b58a997f6d3b4816ed762d94b268bab90f46525b842

  • SSDEEP

    12288:bNr059VawakpWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EVwe1NyBo4kx929bL3Hnx

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 42 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4976
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2436
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1812
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4660
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4620
    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3576
    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1556
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4224
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:5112
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4360
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4688
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3160
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3324
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:664
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:1724
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:3696
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2628
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2388
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4040
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:2920
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2216
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2788
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:4752
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:3112
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 944 2748 2800 928 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
        2⤵
        • Modifies data under HKEY_USERS
        PID:1404
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 944 2836 2832 928 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
        2⤵
          PID:1064
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:3804

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

                Filesize

                2.3MB

                MD5

                cd7a02a2c483b41a3b3f85f3a1fe2a20

                SHA1

                37c1257b7c6322171ee676f881e3ae7dc13ca5fb

                SHA256

                45f8dc83f0bd0966d21f6b22e0854d5acbd96c946a0fa283a6bb4d79e61a5261

                SHA512

                c25cd39147a691cbeb92c24b77c91d374625f0759b5a5f64a18cff074405631f327bf9048825dd85aa5bc8e58ba8fb049c66a2cb67d4b2579c061887ed1acd23

              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                Filesize

                1.4MB

                MD5

                dac80c5a107c090448abfbdcc4ed9318

                SHA1

                e678c6e66f26198e952dda30d3ec66fa3e1ec6ae

                SHA256

                be226da5d4a5216c0dbdd60a50296973db01de1aea050ea95187ed352043e34f

                SHA512

                d75f1de4188e5017e571810124b1f3b537a6cadbe7808c2ef3b82409d7312f52da7fbe4819137887c4ab5ee1295e8e0e066b5a2e600190288fadc1d86cbf5f8b

              • C:\Program Files\7-Zip\7z.exe

                Filesize

                1.7MB

                MD5

                097afbcc7bb4a8b58fe0484796ae9047

                SHA1

                88253c733ce74239333478129ceec7bc438d0e31

                SHA256

                312ee5a1c9dad6e3dd7e5828b79da8bd9b8638b47afffbf7f25ca15c088116a8

                SHA512

                7fda0ec388b0343361d07166a193fde8cfdb82af723818d5bee21eebd0bb77f6bd1f5c9c26161512479481325f3b9e653a16272c5130a2bfa5e5dcc767760df6

              • C:\Program Files\7-Zip\7zFM.exe

                Filesize

                1.5MB

                MD5

                33da7e528198e7e5b42e898f06e506c8

                SHA1

                f7b2c84ae8459e29ae6d1735a044a7f5ee30c35a

                SHA256

                669d2a30d500366c2eb7f63e83b8a9aba1fa10f124718f4044bcfbb8fcc54fdc

                SHA512

                a5f29acc288330e96ee12b40d6b49c623e3e5584df1fd6f1d90db7e83e42d78e053d57be19b3e48cb1f8e61793284f7b7e41657c824b08f6aef896d7df33d5ce

              • C:\Program Files\7-Zip\7zG.exe

                Filesize

                1.2MB

                MD5

                e2a9cf2e5489c15f604dc76008c9e02f

                SHA1

                3370be39e8e05462b07e1da9025daeb0960d3f54

                SHA256

                2398988144f3134c6133510865f156a1e684e1da6c92bf2cd6571674bfa1be38

                SHA512

                1f2a6332708b544cae9a76cf334c76878c482bb80521cbbe61720df7ea74a97681aadb507a820ddf3f1cc86a36c24dac7218e58cdf9c72dbff3eef7413a431fe

              • C:\Program Files\7-Zip\Uninstall.exe

                Filesize

                1.2MB

                MD5

                93f2f6c56f911939e3f75164aa1583c2

                SHA1

                03544ab2829f200d97f6d74729157ecbf1e683d5

                SHA256

                399cc4d77701c2701e1898511787c7fcdcb135f21661845fd30039be4ccf138f

                SHA512

                425f2f3e5b50302658a45157c098963b50d55826ab2821bccec755217c3aabefb837f69771086a7fd32fc96f37d8f4885d62c5fc29988a7607ca52b963aeb985

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

                Filesize

                1.4MB

                MD5

                8b2e8047a29e4a6c6d6ecdfdc387d7ad

                SHA1

                b4e7fa6ea6a98c2e2421942051b8d56ef95aaa10

                SHA256

                53e933ab060ec614c7a7710b90edaa2a3675fe8bf3bd7226b722202a4660a489

                SHA512

                d08243b9343ab1b2f87b40fe0fcbc990e20cbc506a330c5a1f39cdf11a107aa162dc080ff975d9fc2dcbb611a3fdabb839a3a77164b9af0dda6834184c7607ef

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

                Filesize

                4.6MB

                MD5

                a9148e324dc8b1114fc2b0977f16b6fb

                SHA1

                bc0ee5acb36cc310ab7ccf303a6660c7205b3f7f

                SHA256

                2c2e9d9740438709f7bb29a27a4d8680987024fee32e0e3fb7b95e1f72fe6d84

                SHA512

                a880954a8bda0a0428e24637732434124a55beeca87706755bdb4a10880453fb57dfc9e6a0d7628f0065bccefa06d0f1e229456a413212fdb83e8fc4b3d0984b

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

                Filesize

                1.5MB

                MD5

                f5ba88d2a79794d866ca563f889c79eb

                SHA1

                49b4449f7bc263642eb2f84b21d6a342a488e0ab

                SHA256

                3850c838ff865a200f7240f4d8b88beb51b4fb1189e4d1af4d589654a07318af

                SHA512

                6d885b5245f8718522a92462a366a5e4ad805bd4942b421f59175cccd878d8288906ca93d05ac3b1e69f11c8b1d1824f63c11659d35774846ffeb548be034110

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

                Filesize

                24.0MB

                MD5

                9d64451b56e337ce184c79f1e934c37b

                SHA1

                4cc8f4066a99a36ce26d42a6954bfa7829ad6c2b

                SHA256

                65cabb2bcbf948bf5c06818b370fdffbe5fefc3e16c09eee7b90338fa250e100

                SHA512

                ec49ab0f5519444cd88d5af31cf2ee7bb801fcc529e2a398f8ad9a5fe887b90382f06f0039442d4e8ad9bef34a2a4e51f972352bb731f560efa2af6755698c2a

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

                Filesize

                2.7MB

                MD5

                488718367aeef20252a6108e8289a306

                SHA1

                d5e0c071e0e0707f182b612906997eb3df0ed408

                SHA256

                e908adfe82fce439297d4551708ca9cc1c85675dba2cd70df4fe0a68d4844b10

                SHA512

                adeb8a3f654195b9c9701bc066a10404dcc0059ba5164269c621c00376c827047e23905936f9a4bad8236f41cf09446d452ef9e54af4c059b758fae475c6fc51

              • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

                Filesize

                1.1MB

                MD5

                2c443b1ff5c471c6a44ec9177c7603b1

                SHA1

                9482c03c2537160e3778b3a3c9bceec3df794d21

                SHA256

                6aa696ab5242cf4660de5e7664bfe8a6b62546949e8ad51ed07eba7e1d923a56

                SHA512

                72c5b0c57ff422f52ac7829c6dc1535aeb62f5994fd472c584c2fd21acc79ee5c14289287df0a0dab586c252964bc9f8538b3cba9cda4b094f5e331f5690f760

              • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                Filesize

                1.4MB

                MD5

                01c65c5b4fa36a7c0e6880f7a85196b5

                SHA1

                733c744c2d2a26977c7cb7d0bff9e8afd876b42a

                SHA256

                e2e7ebc087b0e6ba7878b8d05b6cf41dd7f94f12172a83ff7d8e3284b20913e6

                SHA512

                ce912d4caa15f82a469f0e68d60b0e0b79a8da33801a468522167c3cce1f1e93c1c9c705bfa9d441dbb26e3704488cd8da8b2c2236794d165cad23a6e53fe819

              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

                Filesize

                1.3MB

                MD5

                a02d723be39d1ddd2a6e474213d6f61b

                SHA1

                811ae7a304dc34955f4d398f75fad1292f889ef6

                SHA256

                5378cbf023e7c57a307f48511c324af0b622828014b128ef9bf5baa36d7bc41f

                SHA512

                f0c9fdc1404a392704a10e6621b396272ca21a409c20eb80b6ec8cf6e082610daf300463ac740b8678f3fe75be9c39b42ab1ee907693e01ff68a87ea436ed75e

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe

                Filesize

                6.6MB

                MD5

                86198685f21d580fa70faa8429d2eb46

                SHA1

                025c791e8c046518f1a9a1042d25a81c9e6657cc

                SHA256

                6538839fbc98eafd3b56ff9fecfb75b98238cb3fdf3c1650d12fd8df9c2abb7d

                SHA512

                ec39ba7d9a3707d6605c16994b621a2f7e6c9e68b479fd904d13636e7de033e830e345839251211a38b034f1c23ace070fbde9892c1d9a7ef42ca701eb431cc4

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe

                Filesize

                6.6MB

                MD5

                3756af2842276a59bab99420661b7a83

                SHA1

                0517e5a58aceafc13018f0064674e907ccefe972

                SHA256

                80735a113c386a3457636f8480f4c87643ef41db5c39d096cc6054027486a5e3

                SHA512

                2f776c6b83735cea8b94454fccbccb4c98e9bb9417366bbee2517585926e0a02e4af0726dd632e630cb866c113ebffd6a3b2ff7db55024b58d80eeda4b545411

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe

                Filesize

                1.9MB

                MD5

                3c1951345349f68ce91d108705a29677

                SHA1

                2c41ebe1df0966b741f394737820da1ad1ac6313

                SHA256

                6a3ca37dceb854efe2fe49a055a92ce0ec85457382882cabaafab648ff5ae741

                SHA512

                669d63247c929b89d099152c137d15a9b460a9320410e2a3d22c965ae8235992279f4c31469346c9802fb30eab1447b7dcee68a06edde5b36a011b7bd32a0dc6

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe

                Filesize

                3.3MB

                MD5

                60f18d8bb2d184f8d8cb6b4a316198fd

                SHA1

                ad478221d1c6b557e8c8eacb210cc5fa6fcbc5e9

                SHA256

                99b96beceb5a841166acc93ec0fe4648252a41da6306f1e5846a5622e74dedc5

                SHA512

                8bfdbf3b4540101e90a8b15728cf050e94a4e705f7616d4ea1703883bcad4b5e570c2d698fcee2af637ba87ea5b2bb3afe71845b5995b559b34bca42c9be87ca

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

                Filesize

                2.3MB

                MD5

                12146a8915ab25f1f3ded6de965aaf2a

                SHA1

                7f3ef2614def09e650881519abfe1f96c13ed557

                SHA256

                ce2a34ee304bc72a965990bfd70e0b3fd83516eddb88c789977958ad4222aeab

                SHA512

                a5464449eb97ec2341ea2986ba53db0f1081ee1a0d7718ad505c9c31b051059a44bc855a8ecfb91eb5a0d94f308eabaeec8151cebadb813a515d295ec000dd11

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe

                Filesize

                1.9MB

                MD5

                b2ab1424a82180e138c26ffa31e7585e

                SHA1

                908b1570cd0b6ad7e8d127b172adc5f875cccf9a

                SHA256

                e83253fd94dd479c3dbe8b269daca37826ee37000efdbddfbac37c383358cf6a

                SHA512

                4431bbf8ca13910ca014852566a40649e7202c7bf44e0e0cda7f8f3150e285e07a4e09e7926516746ab9adbd41dca5f80d684de76dd9f162aaca745d6a74a3d0

              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe

                Filesize

                2.1MB

                MD5

                82b2cc0677038372f7151361c415f1bd

                SHA1

                22364423bdf0904ea40aae3f34bf6df18054322a

                SHA256

                e13d9b446f9206a81fadb3745994835b33d8cda7f63110d97c9e5222b1376ae0

                SHA512

                549636bcb682c9a136c388cc9addf596e6d0479c6760f6caaaae545971c2d33bc68136afab02841a48760af5029ad201ca521cacca8ecd514ee8fa950f85ff7a

              • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

                Filesize

                1.6MB

                MD5

                a69c31e280b7ec205d4d554682fbb0ab

                SHA1

                4a3c6e9d96276314928b2b90d9e44077b761ee34

                SHA256

                1e2f10a123f002c8836df7c67f35d9559f7442990b1de3bf043b639a87644c30

                SHA512

                09d1916df60a56f63a1346b13ca10cf7e240b23aa6d4f5d56931772b7e797668a12054c2d7fd9cf09bb6ea0b391f07165632bebe1427d341cbe99d9432622333

              • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

                Filesize

                1.2MB

                MD5

                ccaf818167329942b039a25e44e063a8

                SHA1

                edd36cce0c4e348fb42307f703656485c97272e2

                SHA256

                ba2e7d6748fc358bd87e5e10e3bd42d3da315de8a0c076112b521818d31c2568

                SHA512

                a75415b394f15d7cabead86281fb2e6bbb5bea1059d284cc55d14227fb318213fcdf6e5b829997a3d5f7cc122a32f5dcc98744845b3551492f993990cfc1c1de

              • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

                Filesize

                1.2MB

                MD5

                efc24ff00c45fd544e965c7c2c1a01b7

                SHA1

                e90882ed1de4badfcb5489d1c6c15ecd93f70cea

                SHA256

                bf7705619b6d122b64217b80f3b5752d12d9bb90d63173bb5a3c4031c5d376f8

                SHA512

                81a30fc8c27a669e29c25b7d1b0d28cb7d12e0b720973e6161817da86fbc3fba8038955d2ed9af0e118037ac4e17ff67bc28fa561aab435e65cb41a4c4e744be

              • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

                Filesize

                1.2MB

                MD5

                b6f89a0b97d10dd3732f281fa4b055b9

                SHA1

                bc1a161d7664051bbceec353abf33740673c3fac

                SHA256

                6caa0d46ba9061fb6087843f55f4646cf545b74ee66e4963928b076d354c2109

                SHA512

                3652029e53cd1a10be61d2d439d646b9aeaf016474e1703a342ec0d349d2d993198dbb1b320040bee1c11a772ff4bd1fd61c705887536806653bdf2620917d61

              • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

                Filesize

                1.2MB

                MD5

                1d6877e6a3e8019a3034243b5ac409b4

                SHA1

                4d91e39e895d078f71ce4b8ea225e5c12b67bd92

                SHA256

                daa4a9fd4cf27abf9d32be7440725ba2e3f5b4dcc51c4ecc2dd9ec84ccadf8f0

                SHA512

                15a0871d366543a2c655bdc303e4d01d2929cbc874c511662d5113b92f28b84eab3b7218691bc8865ac492977f31769010b4aeb7fd656b47270a520b189ac8a4

              • C:\Program Files\Java\jdk-1.8\bin\jar.exe

                Filesize

                1.2MB

                MD5

                965cb261d94cf8eeffd2990d1bb8e689

                SHA1

                166db0e286216c61da5555e03f76d126d423b5d5

                SHA256

                dde6bc7ad9c1577c00b1a29a483f917cbb22b6e24aa5b07e620220c6efe2c69e

                SHA512

                793025a5e9c936e7fa6985a7deb2c7da5c16add9a897a6064aca26354e17275b96488a2ac96f7af30bd0a1f62f3ac8a7a02ba9b6df5800a7210bcfbb416c8dd6

              • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

                Filesize

                1.2MB

                MD5

                62b96975e3d1fc0a00fecaf5a476b24a

                SHA1

                db587926920aa6fd08c4ce71563bf2fdc5a9d7ba

                SHA256

                b491254ecf01a946e1ad4f2ae3454af0d2ff1d18df2c4fa58c28be82d7b5eebd

                SHA512

                a3d12f47787672c641c6d88b9c955c6e84614c448ad70cadafb64f18cd0deb645f4522222494c7de1df219882f8f045c2f03021f310391dd0cfb9a96b55962f6

              • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

                Filesize

                1.2MB

                MD5

                2eda96591073d1628744e0eb2e202cdf

                SHA1

                0593fbdfd58164cd512b10a65bf6bff880772d61

                SHA256

                8c977276da8f282698af93f16bcbf45921951e2fb3a42d7548ee94f2d811ed64

                SHA512

                2fe84c5ca8da795edf77d5a630b97ae7266b328783ac96ba343883805d4c417c8234afe0f8112bf36b168fab95e4b4209d5d89882ed5ba5c9baede7770a93eb1

              • C:\Program Files\Java\jdk-1.8\bin\java.exe

                Filesize

                1.4MB

                MD5

                3f43abf65d9043ce3c9e47ed31a8d244

                SHA1

                f0707dd65eaddcef16033d5e605d11ffb637ba28

                SHA256

                f64b94bf005dc87ecb18b740e4ed7935654aed685a71405abc6622493713569b

                SHA512

                26f520d74fae3ee16b5f1924585f110a4154966b9c2e43be82b28ba114e535c0f51cf3e604f9c928f79e47c168cae01ee3148956657f9a4784b1c01c19ca2e17

              • C:\Program Files\Java\jdk-1.8\bin\javac.exe

                Filesize

                1.2MB

                MD5

                92fb18453770502f4b16f4a7195d049a

                SHA1

                84bed619f5fe4a870d982af953931fa6c8880994

                SHA256

                f5d4aa0261bc2b35c6e41b0b49398d08c7bbf0b0fde9ce5a6210f6c744dbc656

                SHA512

                08ca6761c759d3fb65c8e8b32ef400f00309534ce5a3d5ca99560b5fc0129f288f49260192d922902be8cc76c5ebeb0c4b3ac7cc3b113457b9173ae7997581f6

              • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

                Filesize

                1.2MB

                MD5

                388d0fda2d64200e66984e9c4fd2d7fb

                SHA1

                7131c80fc12b3bbf8ba4e29f6a684da468a0ddff

                SHA256

                a904a7236e7403c2ca0b44c42853ce0ee6b32007d013c70a289a282d493eb229

                SHA512

                35e913b476d51112b51808dcd84b1a2013e5a2b44bcfb7e141eff65c006704039a4afd9e1479940f6715ab75b5944ca048514c10769a7b0913b8db596fa5a3bc

              • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

                Filesize

                1.3MB

                MD5

                17378916b2be54442ddd31e980bd9312

                SHA1

                447da5a7775b50da32331aa87c22019abead870b

                SHA256

                4b74cdd252c4f18354562d2db140fbf8b572710e38872a5d8262c66c2b641da6

                SHA512

                5fc423f76fc351b1cd17fb48c511c24962ede098235a7c93c77d148c3ec756c380f8f84297c5dad2507263250cd5d8e9771ae89d810ea2258628b93dd05739d8

              • C:\Program Files\Java\jdk-1.8\bin\javah.exe

                Filesize

                1.2MB

                MD5

                4da907f6777012c98eb6acd528ada29b

                SHA1

                ad3223076797c73c19acf92a5f2db511c65c4763

                SHA256

                4afe3590c726ef2fad6630c3318d570d37b3f238aa3727cf6e1ac30333484354

                SHA512

                0f609a458d3784b477a0b6d5c1b830a4e31d39cac1f500552a83e612ac3a9cdef2e726cdefc387bef46de86e130ee27bc7d3ff8064599f3fa2ee982335b4a610

              • C:\Program Files\Java\jdk-1.8\bin\javap.exe

                Filesize

                1.2MB

                MD5

                cf5a590dbf373a9edb1ffcf9b5189dfb

                SHA1

                0e17ce283a5da92d76492c85f82ca9fa74998c16

                SHA256

                7996d0ab1effb37c66a1e18dd19ead6338aeff8ba9a863e9a0d5e4c17fa345f9

                SHA512

                fac618ceed0cffe313fd18a7af05dc1e4985c302e5dd9ca77ba48c1514bef7a3937e1de0d2ef65924540b08b655ff7aa69110e1ec92c655ceb220301b3a97d67

              • C:\Program Files\Windows Media Player\wmpnetwk.exe

                Filesize

                1.5MB

                MD5

                d0cc2339351f940a7c741b127eaf52e2

                SHA1

                9123403d3eee87466447741cb211856816eeed2c

                SHA256

                cfc3afe25a798436b63f4355f252ec9a23e79629116de74f36786bdf1e3d3cfd

                SHA512

                debf1500cf1080af8ccd27fe0445acfc66ef297424cd81bec1c289af2c4ad0813444add515b18782fbabdb68dc9a90591703c50b5c9b1657c9f673db0afcd729

              • C:\Program Files\dotnet\dotnet.exe

                Filesize

                1.3MB

                MD5

                3c0db6ad66fd7820ca3ccb094249f6fd

                SHA1

                07db6f71732f3cfd4e320000d1c41a7b26338704

                SHA256

                d85930dd1f60a1ca459ec0826d9115e165052ead003be6481083ac18d844b77d

                SHA512

                3908b21b038e811405ce6369c7d0bea833f644f970aa7f9ba12f20aaba01331fcde47bcd4fac302c8e8feee08466af6db4ab29fe5f8c8c3279645688adbfa282

              • C:\Windows\SysWOW64\perfhost.exe

                Filesize

                1.2MB

                MD5

                4cdea77d3d90400d78ba04c9c522c2ec

                SHA1

                7d9954dc53866c9ecad1f9315fe6d71a528e808e

                SHA256

                132d3e270f11f5e200b07d9e0b9b456a44c8515007822afcdabe4206adc5844d

                SHA512

                617b9e232d668267e3bfc20a226f7b605c8210b70038dc705b683398843b53b21864cd42d1e2d8d1820291923ee15d3242c79ee8664accfbac00e1796fa6be03

              • C:\Windows\System32\AgentService.exe

                Filesize

                1.7MB

                MD5

                52b782ddd27fe10ef7a0b7761146cc50

                SHA1

                09cb42ace034dad3baaf5fa5c238eccdf222ca8a

                SHA256

                a3d505be1e49d62a91e30aa9026ed0fde3d12ec7a2a1fc2d513656cef4b06f44

                SHA512

                c7210044f6461821fde0f79740c09c2b8c639279a4ac91e1b921c69c195a7cbc6d3f74577a517b427933efe46420634fa44280138529843dd012c01f2d3f5ade

              • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                Filesize

                1.3MB

                MD5

                084a3732e34e5a4ec1e59af3043d36fb

                SHA1

                d24d9a03055ff4ec46af44ee5d2baee52e44d2ce

                SHA256

                33446d6c5f978f68ac70b4eda7698bc1157f64410dba38dc817e641dff47d988

                SHA512

                e18e03e24fd4a4004f4187b147e962d661c75e8eb2491bb985d14c4a85bbc97ebb1ca68ae280a3bac7a4eaacd7ae6ddfbe2a148a78d138232d16d5651b71390e

              • C:\Windows\System32\FXSSVC.exe

                Filesize

                1.2MB

                MD5

                298538d57b8a2102ba3a8331ec95f69f

                SHA1

                774f9ba82870c3d084b7c020de6aa2cfdfb920a6

                SHA256

                4fe4f39a1f7415caddd2f7cdb900342082922443a2bd86597b471c8969363bfb

                SHA512

                753bd1b4d57bcc057ac9b946a61e003f33532801a4ce262b8b768d50d0f72c572f66c3ede8dbbc23d4eb5ded46eed5970bc41d341f47402b4138d064db685352

              • C:\Windows\System32\Locator.exe

                Filesize

                1.2MB

                MD5

                4538fc2ec8b5c3f3a0f6dad2c1fe354f

                SHA1

                1a5299e7d471b3dc00695df6d0d2135b25547b83

                SHA256

                ba56e1206f64fee778e80b8c1a1d32faeff54207a9939b3717eeda392fc20fab

                SHA512

                9deab6bc01e2b8c2e4fde4ab660f6c89b0eae9ddce137747c135b8cb14b5382801012c81c7d9fd5b7e826e11f33e86f4374f2c054fe7f1b81362b65a6b3c59ca

              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                Filesize

                1.5MB

                MD5

                5946bb23a2d1c755b383c98e7a5a6d0b

                SHA1

                ab011e69908b7453fffadce5ecd2fbb618e25e6f

                SHA256

                336e4714d43f1fd52de4fe2aefe2e4cb51ecf636a369066345a82d4d2584ea75

                SHA512

                2cda82eb0740ce7c35d0962db3cdfcfa66d974315872150a7d2239d1ef9bf3b9679700643b7e4f048a69d85595a07a56d814c31592871f6ba7e1e0b2000f76fa

              • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                Filesize

                1.4MB

                MD5

                acd75ea266208a5491b306524aff6c4e

                SHA1

                a6a0ae8ce77916d0e34a600532399407f0308482

                SHA256

                2b2532433a5a15bbcef781024aa6124bc817033e7fff1a0609c83889e13effde

                SHA512

                dc59b51593c5c4d824ab0d610763dace2c9cb996a7e7881e363a5cb4f663a933f159467195b1e6b519b8ee1e4be1d5a708431ed63c8bdc09d2e3ba1846fe202b

              • C:\Windows\System32\SearchIndexer.exe

                Filesize

                1.4MB

                MD5

                907b988ee4b31301eda7a7d2036c1bef

                SHA1

                8d3f3f566e74cd5d006c4a0c6624fe8b888fc5f8

                SHA256

                0beb07952386ee689af7fc464784bcc05c05679f95978cb3fae9d34662c5f1f6

                SHA512

                62389fba1fc60400b9afdc610d335d79c31f74490702302e1669b0988dcfa5341676b5bdd5fe19bb24f068589b2e72d71ea1185dd13cf4f47cb73e7d8e7b7f2c

              • C:\Windows\System32\SensorDataService.exe

                Filesize

                1.7MB

                MD5

                2267c7960be029c855317c6744b3bcff

                SHA1

                f8f8c60ad7d6e05611e623ed9246add236042d0b

                SHA256

                8c4cbfcd8837795f4e2b75fce0caddc0d2c7202b34b1b2e08aefa6ed369f96a1

                SHA512

                34764d7044363ba569a41dd4345cb836fbe9322d962dc2dc13a782f54c12e2a1d8b9e3bc63847f63d55245a85dbc532f34ac81b4de28ed454a2372b92aa18d22

              • C:\Windows\System32\Spectrum.exe

                Filesize

                1.3MB

                MD5

                621a8ecee633d55cf67d2fae0c786707

                SHA1

                9d214307f6e02bf72ec6b25c0cd7b718b9107cee

                SHA256

                84bd31cecd4a96c5d447cc400811a99bb3420b65239485fe0d92e2508aeffb24

                SHA512

                a2a15ca18bc380ae5bf7741c9c87287ed0c06ae1b125419f125e852061971570bded46ccc6a214363788bfbb8130a36e3c0dbd5979ff9b6efbd2caf6dbfae4f1

              • C:\Windows\System32\TieringEngineService.exe

                Filesize

                1.5MB

                MD5

                2828ab07677efa3aabb699bd0bba3483

                SHA1

                78ee2720790dbc04346f6e4ef8c874cc6dddc73f

                SHA256

                5fbe75c965a0b4b2c6234c716de2fa8ebff2126eb2fa7f5f5173aaaf132d0d94

                SHA512

                d70682af30b8cf0d9c779b656ade4c225451f1bb39f4e8564976714e7c499dd948140b983228113b912ce4fa469e73d525aa30453fadd738067aa078103bc0b1

              • C:\Windows\System32\VSSVC.exe

                Filesize

                2.0MB

                MD5

                dec21c8239fe6672d1df48f6d7040243

                SHA1

                de80a6529a89892a9f8af8a89b4c5c07c011c376

                SHA256

                2223f2ee043d12556bb0d89cf62ab927dcd0393348ad84718a585fa2fe483885

                SHA512

                081ff982ef5d49c28e013f4c47a99e23ba9cf1dff3b5cb2e3db5a1dc61a403766f2e7758d2dfb7ca1929df9dfedabed7310e79b690a80e1ad87b004d8a41805f

              • C:\Windows\System32\alg.exe

                Filesize

                1.3MB

                MD5

                1f60dfd97b0fe39007c9c624f7cbc7b9

                SHA1

                90fff491fd3f645b4c9c087f118d0685a9448816

                SHA256

                2d97aed03cf7b689d846453ad97fa9fc7db3aee9816161ddab6a2d5e1628869f

                SHA512

                087abfcdca2a84e34e05f84232d320da82d2ab7d72498526a5f06e43f4e01353bdf89a3c6692e14c8f6c3401f8932ac38b23c1eeeebe302a01528abbaf1d3d81

              • C:\Windows\System32\msdtc.exe

                Filesize

                1.3MB

                MD5

                cb74ddd5888b801d6fba9297893ab80a

                SHA1

                50894982b797b2504100e710e1323c26c8acc34d

                SHA256

                aa37d90c6537e0a5ca5679de3a2861ae9c52bb4b65f02d448fc4d78a057ddce7

                SHA512

                2478481df5d36242bc7b9f0988cfd33303f75941dccad1ce43f70389124d5a4990d6bc3d2f90479a00bdbedaa7ddadc83398ff59632424103d6cf3dd996de23d

              • C:\Windows\System32\snmptrap.exe

                Filesize

                1.2MB

                MD5

                38c965d4295cfce090e70e2dfdbcd7dd

                SHA1

                cbcdd928cbce781fd247464e3c777bd83b7d36c5

                SHA256

                dac627926cf47f14a1c16fbe57a6be04a9f47c4d88ac3ab063a48b2d26ce337b

                SHA512

                fae1be0d9f2d60f774213b40fb9e4735ca31c8f818b71efed4a42f37efa90c724b7e0d9727012809071f304e92bed8a5ab45d0c6a57860534d1e4eb3af4d710b

              • C:\Windows\System32\vds.exe

                Filesize

                1.3MB

                MD5

                9eee3a126e859074ae0160daa926445b

                SHA1

                7ecddc5a65f46a601ae99c917fc9e5b1852394df

                SHA256

                871de4f1e53b70733cb7d11c0d9cc3c13a58c1317dbf9ab80a3b016878a01e37

                SHA512

                4ee1a8da525bcb9cdd309918968f9f3e59717326e28081be5b0c1ccc2273185ebe9949e7cbe45d7cef929e88450a8fe649eac12bbbb58d8fbbbd281b178662fd

              • C:\Windows\System32\wbem\WmiApSrv.exe

                Filesize

                1.4MB

                MD5

                553605914bd8c7edb8bd59c9e972a075

                SHA1

                1f96b2fa1cc04d4ca1621c0df6d0778bbedb4264

                SHA256

                77c6cae55e59f1c5380d971d0c7b2543033aeeed11b17e1d1817dfc829d7cc4d

                SHA512

                31a6414be478147797d6e2c6b37c12a682b21d8ca7f889d7a2b551dbaf1d88ca8063379821aa4b9865b6f67cfcf617e7727350f2ce3596149b3096ad0b258e52

              • C:\Windows\System32\wbengine.exe

                Filesize

                2.1MB

                MD5

                a7f77f5870ed6526094f3ebc492e148f

                SHA1

                122578bfa5a8917c418b6fe16e8a9edcbbd0e70c

                SHA256

                fb1e24ed9068ff5b959270105210fe70c19ac0f6f10c2da6566954e3465d1e88

                SHA512

                e9d8100bf62a6ca7480af5502bc86b0e1f8fd1a95e65079f412518efb5643048977c2900f4acfa483fc90e42bb4d6f9c9fd8869aeba55e0527080ffb75f2fd06

              • C:\Windows\system32\AppVClient.exe

                Filesize

                1.3MB

                MD5

                c1a8e53aa0b7f59b9adfdbc2728134f3

                SHA1

                e9d49514961b68946b8589bd76fcc40f433061f2

                SHA256

                88708ac258c668c6a82c193f0939af59d69a257156dd0991a412aecf41c8c9f6

                SHA512

                5383678115536196483199169aa1f4066c156d44c7a6b300d0980ffd84a98649205c8cb886c8e81439f52481aa1b380b4d2afa49528a076d9fb4d2c59e6cb33a

              • C:\Windows\system32\SgrmBroker.exe

                Filesize

                1.6MB

                MD5

                b7422aa305f844527b66404f99549dca

                SHA1

                cc08c86d7907fa269f4d10df709eb67e7fb33987

                SHA256

                293c76448112b6a15c2d99d566c7d431ba739d5f80123b0dc066fa9a2bd29b42

                SHA512

                9ae84015ae19c2a279d3065064b7c3f8d3eea518fc2067b28d248156780e65b743649aa92270db1d42177314877dae1477bcc3e511270d7fae8da6a419ef0b44

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

                Filesize

                414KB

                MD5

                16b9618962f5623ca791a1366eee5708

                SHA1

                f0d257511952f075b2a0ec7d8e8730c3e464461a

                SHA256

                e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d

                SHA512

                18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2

              • C:\Windows\system32\msiexec.exe

                Filesize

                1.3MB

                MD5

                b10d4acfae1584c536e5d55d2c70e0db

                SHA1

                4089c67c98cf1c6cbac0aff30e18cfc34d444cec

                SHA256

                b5119e1936c5ee891dd41a32b347bffa6cb45f007738ff3d60cee1067cb532df

                SHA512

                7f793467546200c7c7bef78a6ea31510a333fd85a0516111e624f5b97e42ec5f40ed317b4cc0baee647662cec75c5ba5238b6d12dfe474b5553d5376926ce2fb

              • memory/664-537-0x0000000140000000-0x00000001401C1000-memory.dmp

                Filesize

                1.8MB

              • memory/664-127-0x0000000140000000-0x00000001401C1000-memory.dmp

                Filesize

                1.8MB

              • memory/1404-402-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-396-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-378-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-379-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-380-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-381-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-382-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-383-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-384-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-385-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-386-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-387-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-390-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-391-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-393-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-394-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-375-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-395-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-397-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-399-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-400-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-372-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-373-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-374-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-401-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-403-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-376-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-377-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-389-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-388-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-392-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-398-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-409-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-411-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-410-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-408-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-407-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-406-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-405-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1404-404-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

                Filesize

                64KB

              • memory/1556-50-0x00000000008F0000-0x0000000000950000-memory.dmp

                Filesize

                384KB

              • memory/1556-52-0x0000000140000000-0x0000000140266000-memory.dmp

                Filesize

                2.4MB

              • memory/1556-44-0x00000000008F0000-0x0000000000950000-memory.dmp

                Filesize

                384KB

              • memory/1556-156-0x0000000140000000-0x0000000140266000-memory.dmp

                Filesize

                2.4MB

              • memory/1724-128-0x0000000140000000-0x0000000140136000-memory.dmp

                Filesize

                1.2MB

              • memory/1812-130-0x0000000140000000-0x0000000140148000-memory.dmp

                Filesize

                1.3MB

              • memory/1812-26-0x00000000007D0000-0x0000000000830000-memory.dmp

                Filesize

                384KB

              • memory/1812-17-0x0000000140000000-0x0000000140148000-memory.dmp

                Filesize

                1.3MB

              • memory/1812-18-0x00000000007D0000-0x0000000000830000-memory.dmp

                Filesize

                384KB

              • memory/2216-160-0x0000000140000000-0x00000001401F6000-memory.dmp

                Filesize

                2.0MB

              • memory/2216-535-0x0000000140000000-0x00000001401F6000-memory.dmp

                Filesize

                2.0MB

              • memory/2388-148-0x0000000140000000-0x0000000140181000-memory.dmp

                Filesize

                1.5MB

              • memory/2388-371-0x0000000140000000-0x0000000140181000-memory.dmp

                Filesize

                1.5MB

              • memory/2436-13-0x0000000140000000-0x0000000140148000-memory.dmp

                Filesize

                1.3MB

              • memory/2436-101-0x0000000140000000-0x0000000140148000-memory.dmp

                Filesize

                1.3MB

              • memory/2628-143-0x0000000140000000-0x00000001401A1000-memory.dmp

                Filesize

                1.6MB

              • memory/2628-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

                Filesize

                384KB

              • memory/2628-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

                Filesize

                384KB

              • memory/2628-370-0x0000000140000000-0x00000001401A1000-memory.dmp

                Filesize

                1.6MB

              • memory/2788-164-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/2788-536-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/2920-157-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/2920-486-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/3160-180-0x0000000000400000-0x0000000000535000-memory.dmp

                Filesize

                1.2MB

              • memory/3160-102-0x00000000008C0000-0x0000000000927000-memory.dmp

                Filesize

                412KB

              • memory/3160-107-0x00000000008C0000-0x0000000000927000-memory.dmp

                Filesize

                412KB

              • memory/3160-126-0x0000000000400000-0x0000000000535000-memory.dmp

                Filesize

                1.2MB

              • memory/3324-131-0x0000000140000000-0x0000000140134000-memory.dmp

                Filesize

                1.2MB

              • memory/3576-41-0x0000000140000000-0x000000014025F000-memory.dmp

                Filesize

                2.4MB

              • memory/3576-33-0x0000000000900000-0x0000000000960000-memory.dmp

                Filesize

                384KB

              • memory/3576-151-0x0000000140000000-0x000000014025F000-memory.dmp

                Filesize

                2.4MB

              • memory/3576-39-0x0000000000900000-0x0000000000960000-memory.dmp

                Filesize

                384KB

              • memory/3696-229-0x0000000140000000-0x0000000140149000-memory.dmp

                Filesize

                1.3MB

              • memory/3696-124-0x0000000000710000-0x0000000000770000-memory.dmp

                Filesize

                384KB

              • memory/3696-129-0x0000000140000000-0x0000000140149000-memory.dmp

                Filesize

                1.3MB

              • memory/3696-118-0x0000000000710000-0x0000000000770000-memory.dmp

                Filesize

                384KB

              • memory/4040-152-0x0000000140000000-0x00000001401AD000-memory.dmp

                Filesize

                1.7MB

              • memory/4040-153-0x0000000140000000-0x00000001401AD000-memory.dmp

                Filesize

                1.7MB

              • memory/4224-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

                Filesize

                384KB

              • memory/4224-69-0x0000000140000000-0x0000000140174000-memory.dmp

                Filesize

                1.5MB

              • memory/4224-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

                Filesize

                384KB

              • memory/4224-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

                Filesize

                384KB

              • memory/4224-66-0x0000000140000000-0x0000000140174000-memory.dmp

                Filesize

                1.5MB

              • memory/4360-81-0x0000000000870000-0x00000000008D0000-memory.dmp

                Filesize

                384KB

              • memory/4360-84-0x0000000140000000-0x000000014016E000-memory.dmp

                Filesize

                1.4MB

              • memory/4360-168-0x0000000140000000-0x000000014016E000-memory.dmp

                Filesize

                1.4MB

              • memory/4360-75-0x0000000000870000-0x00000000008D0000-memory.dmp

                Filesize

                384KB

              • memory/4560-227-0x000000000A520000-0x000000000A528000-memory.dmp

                Filesize

                32KB

              • memory/4560-177-0x0000000000910000-0x0000000000970000-memory.dmp

                Filesize

                384KB

              • memory/4560-190-0x0000000001C30000-0x0000000001C40000-memory.dmp

                Filesize

                64KB

              • memory/4560-206-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

                Filesize

                64KB

              • memory/4560-171-0x0000000000910000-0x0000000000970000-memory.dmp

                Filesize

                384KB

              • memory/4560-181-0x0000000140000000-0x0000000140172000-memory.dmp

                Filesize

                1.4MB

              • memory/4560-539-0x0000000140000000-0x0000000140172000-memory.dmp

                Filesize

                1.4MB

              • memory/4620-30-0x0000000140000000-0x0000000140136000-memory.dmp

                Filesize

                1.2MB

              • memory/4620-53-0x0000000140000000-0x0000000140136000-memory.dmp

                Filesize

                1.2MB

              • memory/4688-179-0x0000000140000000-0x0000000140168000-memory.dmp

                Filesize

                1.4MB

              • memory/4688-87-0x0000000000BD0000-0x0000000000C30000-memory.dmp

                Filesize

                384KB

              • memory/4688-93-0x0000000000BD0000-0x0000000000C30000-memory.dmp

                Filesize

                384KB

              • memory/4688-96-0x0000000140000000-0x0000000140168000-memory.dmp

                Filesize

                1.4MB

              • memory/4752-169-0x0000000140000000-0x0000000140160000-memory.dmp

                Filesize

                1.4MB

              • memory/4752-538-0x0000000140000000-0x0000000140160000-memory.dmp

                Filesize

                1.4MB

              • memory/4976-0-0x0000000140000000-0x0000000140127000-memory.dmp

                Filesize

                1.2MB

              • memory/4976-554-0x00000000020E0000-0x0000000002140000-memory.dmp

                Filesize

                384KB

              • memory/4976-83-0x0000000140000000-0x0000000140127000-memory.dmp

                Filesize

                1.2MB

              • memory/4976-9-0x00000000020E0000-0x0000000002140000-memory.dmp

                Filesize

                384KB

              • memory/4976-1-0x00000000020E0000-0x0000000002140000-memory.dmp

                Filesize

                384KB

              • memory/4976-552-0x0000000140000000-0x0000000140127000-memory.dmp

                Filesize

                1.2MB

              • memory/5112-71-0x0000000140000000-0x0000000140158000-memory.dmp

                Filesize

                1.3MB

              • memory/5112-163-0x0000000140000000-0x0000000140158000-memory.dmp

                Filesize

                1.3MB