Overview

overview

10

Static

static

3

Filezo 6.0...CK.exe

windows10-2004-x64

7

Filezo 6.0...CK.exe

windows10-ltsc_2021-x64

7

Filezo 6.0...CK.exe

windows11-21h2-x64

10

Filezo 6.0...CK.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    299s
  • max time network
    297s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/07/2026, 19:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Filezo 6.0.18 + CRACK.exe
  • Size 90.0MB
  • Sample260715-xvfdcsf17x
  • SHA256 439b73b50c9e5c161b070a4eafa6a56ddb4ea6daf155b8dc06105028a7d04fd2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebootkitfilezo 6.0.18defense_evasiondiscoveryquasarinstallerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.3.0.0

Botnet

  • Filezo 6.0.18

C2

  • stopman.ooguy.com:2002

Mutex

  • QSR_MUTEX_Pn3vK12dAfUdfWUHbL

Attributes
  • encryption_key

    tMNJA2RQy3CbPm9vBHFT

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Filezo 6.0.18 + CRACK.exe
    "C:\Users\Admin\AppData\Local\Temp\Filezo 6.0.18 + CRACK.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\FilezoSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FilezoSetup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\is-A81I7.tmp\FilezoSetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-A81I7.tmp\FilezoSetup.tmp" /SL5="$5030A,93444415,832512,C:\Users\Admin\AppData\Local\Temp\RarSFX0\FilezoSetup.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Users\Admin\AppData\Local\Temp\is-0C56U.tmp\vc_redist.x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-0C56U.tmp\vc_redist.x64.exe" /q /norestart /c:'msiexec /i vcredist.msi /qn'
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Windows\Temp\{ED1BFC14-344E-4068-A5FE-9D4675FE65F2}\.cr\vc_redist.x64.exe
            "C:\Windows\Temp\{ED1BFC14-344E-4068-A5FE-9D4675FE65F2}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-0C56U.tmp\vc_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /q /norestart /c:'msiexec /i vcredist.msi /qn'
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4412
            • C:\Windows\Temp\{FA19B606-E0A9-433E-BCDC-05262C05D97F}\.be\VC_redist.x64.exe
              "C:\Windows\Temp\{FA19B606-E0A9-433E-BCDC-05262C05D97F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4A1EB2F0-9494-45F4-A3D0-4289A53E177D} {8FE33A07-BAA0-47F9-87F7-6EB78E87CB36} 4412
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2180
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Conceptworld\Filezo\Service\FilezoShell.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:3004
        • C:\Program Files\Conceptworld\Filezo\Filezo.exe
          "C:\Program Files\Conceptworld\Filezo\Filezo.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2816
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\filezoHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filezoHelper.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2072
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2808
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:940
  • C:\PROGRA~1\CONCEP~1\Filezo\Filezo.exe
    C:\PROGRA~1\CONCEP~1\Filezo\Filezo.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies Control Panel
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\PROGRA~1\CONCEP~1\Filezo\Service\FilezoService.exe
      "C:\PROGRA~1\CONCEP~1\Filezo\Service\FilezoService.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4420

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Browser Extensions

        1
        T1176

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        1
        T1112

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Virtualization/Sandbox Evasion

        1
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Virtualization/Sandbox Evasion

        1
        T1497

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Filezo.deps.json
        • Path C:\PROGRA~1\CONCEP~1\Filezo\Filezo.deps.json
        • Size 53KB
        • SHA256 34d68a005c9f494410d02633cf13c0722888d8ff45ce8d09aafb114d8d9d7ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Filezo.runtimeconfig.json
        • Path C:\PROGRA~1\CONCEP~1\Filezo\Filezo.runtimeconfig.json
        • Size 834B
        • SHA256 b0e9fca3b7f93e8cc7fd576a222b6cd0fd3e18fa394b0bbd0bde3261747a2f7d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft.UI.Xaml.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\Microsoft.UI.Xaml.dll
        • Size 14.3MB
        • SHA256 2ed4180af105eaac4b64943f34e669c47608c8dea6bb7317c561eb7ea7b86d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.WinUI.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\Microsoft.WinUI.dll
        • Size 7.0MB
        • SHA256 3a2ed181a4331f2ceace6002e0e3bd8d9797becc32d3978cd2894036cca0d7b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Windows.SDK.NET.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\Microsoft.Windows.SDK.NET.dll
        • Size 25.2MB
        • SHA256 5f7dc195b945208342c4cda2f93e95c2d2e1dbf8b41aa846556d58b618d7cb1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Numerics.Vectors.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\System.Numerics.Vectors.dll
        • Size 15KB
        • SHA256 9f5efe34460c70938eaacfe4c240fbb4ab1245e056a81a192e8bf595743b05a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.CompilerServices.Unsafe.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\System.Runtime.CompilerServices.Unsafe.dll
        • Size 14KB
        • SHA256 652682d81c3b6427e2c389d2c6c170783fd7c6e6f8808afc4b66c82e1f918a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\System.Runtime.dll
        • Size 43KB
        • SHA256 e62828b723834b92120a4be737b34e24db2cab4080110c3fc8c599e661d54bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\System.Security.Cryptography.dll
        • Size 2.0MB
        • SHA256 ad5e49b04ca3b0df8ccc661306c7d67a2b46298732122d2e8583ea02b1180245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinRT.Runtime.dll
        • Path C:\PROGRA~1\CONCEP~1\Filezo\WinRT.Runtime.dll
        • Size 516KB
        • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CoreMessagingXP.dll
        • Path C:\Program Files\Conceptworld\Filezo\CoreMessagingXP.dll
        • Size 1018KB
        • SHA256 b3841c8a46b5a99e6ade2c55131aee51c11822ed5a25d0f8df3a4c9ea17e110b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Filezo.dll
        • Path C:\Program Files\Conceptworld\Filezo\Filezo.dll
        • Size 1.1MB
        • SHA256 223913e6734119f2850cd7c051440d73212ed627f78b593afafd356bc1aa2e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Filezo.exe
        • Path C:\Program Files\Conceptworld\Filezo\Filezo.exe
        • Size 290KB
        • SHA256 4db24ab30c3e99605985c08fbcd5d16988dd9e68b13dc9140dfcf2bf3facbf29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Internal.FrameworkUdk.dll
        • Path C:\Program Files\Conceptworld\Filezo\Microsoft.Internal.FrameworkUdk.dll
        • Size 997KB
        • SHA256 633ecf8d262b1d7626ff35844e4d29ba579549386eb609cc6779bbc4bb2d4752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.UI.Windowing.Core.dll
        • Path C:\Program Files\Conceptworld\Filezo\Microsoft.UI.Windowing.Core.dll
        • Size 530KB
        • SHA256 c4e2765c1c5219b704f14d7dda54469328fd311bdc2db1e09b75df61038df94a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.WindowsAppRuntime.dll
        • Path C:\Program Files\Conceptworld\Filezo\Microsoft.WindowsAppRuntime.dll
        • Size 2.2MB
        • SHA256 89fec903532a888ae4eef250e2d7d0cf0d02574799957f70844c99f28330717a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FilezoShell.dll
        • Path C:\Program Files\Conceptworld\Filezo\Service\FilezoShell.dll
        • Size 109KB
        • SHA256 be1890bad91c7f0c0ccc4e3f0df9561c9b6c30c8a6530c15fc76561a5c011851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Collections.Concurrent.dll
        • Size 285KB
        • SHA256 d9ecc53d078b0d448ec90d1fe8ec155f7dcd5457015bfca22fce5fda25f6d815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Collections.dll
        • Size 325KB
        • SHA256 eb9acf9635849f4f17c1153c6e04a341e01643a9cda64a1051d1b8757603436c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.ComponentModel.dll
        • Size 29KB
        • SHA256 7d563600911624f36292cab1ccd6878063691f1305764346ab9cd6dd0766f566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Memory.dll
        • Size 157KB
        • SHA256 a821a183269331e75d568b550a41c3809fc10c40f43b636e966272707714f434
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ObjectModel.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.ObjectModel.dll
        • Size 81KB
        • SHA256 14303444e0e13f06c4be30ff0ac1b3abb9857afbfea7220aa2d8f394411e5140
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Private.CoreLib.dll
        • Size 14.6MB
        • SHA256 d2ca21672b8aeb3fd926c559380b29e1a9c04fefce2a8f67e7d2e33eee488d3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Private.Uri.dll
        • Size 253KB
        • SHA256 ad8fdc6ee498d08f894704b9e27d9f55a30446271c8961be094045a863016ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 e00abc85ea8444560b037214435105057bb8b56eeb3b1ff53643f1a90b645bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Program Files\Conceptworld\Filezo\System.Threading.dll
        • Size 81KB
        • SHA256 9ed8058487ea594c73d4d5b0d6b0647750996b73ca1421bad57a556b7696ddb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Program Files\Conceptworld\Filezo\clrjit.dll
        • Size 1.9MB
        • SHA256 71e62a0b5cd2ac7cb6255111e0a586345e76813d8a8f6151d25df334cd04b112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\Program Files\Conceptworld\Filezo\coreclr.dll
        • Size 4.6MB
        • SHA256 d9509e3a9920cefe16a10a9b028c555eaf0d7e35c1daf1b7383d52fc40e655f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Program Files\Conceptworld\Filezo\hostfxr.dll
        • Size 365KB
        • SHA256 c3da8c6e6ad0e0f3562132f07270b856030f4d5d191400539215394befd0727e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\Program Files\Conceptworld\Filezo\hostpolicy.dll
        • Size 378KB
        • SHA256 badc87b13c4fca6f9f42a699e902b94111777f148b72d5e8521bc17c64897862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vc_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-0C56U.tmp\vc_redist.x64.exe
        • Size 17.7MB
        • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FilezoSetup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-A81I7.tmp\FilezoSetup.tmp
        • Size 3.1MB
        • SHA256 535ce3b8af14cef4f30d14b3fbc7659cbfdfefc774fce066b76419760b87e412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Filezo.ini
        • Path C:\Users\Admin\AppData\Roaming\Conceptworld\Filezo\Filezo.ini
        • Size 56B
        • SHA256 e5ab318deec4f94a71510280956d890b043640fff939362be2ea90379b64d361
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vc_redist.x64.exe
        • Path C:\Windows\Temp\{ED1BFC14-344E-4068-A5FE-9D4675FE65F2}\.cr\vc_redist.x64.exe
        • Size 615KB
        • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{FA19B606-E0A9-433E-BCDC-05262C05D97F}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{FA19B606-E0A9-433E-BCDC-05262C05D97F}\.ba\wixstdba.dll
        • Size 215KB
        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1080-994-0x00007FFF05790000-0x00007FFF057A0000-memory.dmp
        Download

        memory/1900-14-0x0000000000400000-0x00000000004D8000-memory.dmp
        Download

        memory/1900-1140-0x0000000000400000-0x00000000004D8000-memory.dmp
        Download

        memory/1900-21-0x0000000000400000-0x00000000004D8000-memory.dmp
        Download

        memory/2072-1151-0x0000000001300000-0x000000000135E000-memory.dmp
        Download

        memory/2072-1158-0x0000000006010000-0x00000000065B6000-memory.dmp
        Download

        memory/2072-1157-0x0000000001300000-0x000000000135E000-memory.dmp
        Download

        memory/2072-1159-0x0000000005A60000-0x0000000005AF2000-memory.dmp
        Download

        memory/2072-1160-0x0000000005990000-0x00000000059F6000-memory.dmp
        Download

        memory/2072-1161-0x0000000005F80000-0x0000000005F92000-memory.dmp
        Download

        memory/2072-1162-0x0000000006E10000-0x0000000006E4C000-memory.dmp
        Download

        memory/2072-1156-0x0000000001300000-0x000000000135E000-memory.dmp
        Download

        memory/2072-1164-0x0000000007150000-0x000000000715A000-memory.dmp
        Download

        memory/2072-1154-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
        Download

        memory/2084-55-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-1063-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-19-0x00000000026D0000-0x00000000026D1000-memory.dmp
        Download

        memory/2084-23-0x00000000026D0000-0x00000000026D1000-memory.dmp
        Download

        memory/2084-22-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-25-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-934-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-414-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-59-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-57-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-53-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-51-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-49-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-47-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-45-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-43-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-41-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-27-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-29-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-1139-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-39-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-37-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-35-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-33-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/2084-31-0x0000000000400000-0x000000000071C000-memory.dmp
        Download

        memory/4420-1064-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1043-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1027-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1045-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1048-0x0000000005630000-0x0000000005644000-memory.dmp
        Download

        memory/4420-1044-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1165-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1166-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1169-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download

        memory/4420-1176-0x0000000140000000-0x0000000140EFA000-memory.dmp
        Download