Overview

overview

10

Static

static

10

XBinderOutput.exe

windows10-2004-x64

10

XBinderOutput.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    153s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 13:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XBinderOutput.exe
  • Size 128.9MB
  • Sample260809-qy748a11cs
  • SHA256 ccd8ae24720b77dd753288c6bc2105d21a749acf5fdd126b21bb5d146fb52ba4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencepyinstaller

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 20 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
    "C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Users\Admin\AppData\Local\Temp\htw71d33cav0opbr.exe
      "C:\Users\Admin\AppData\Local\Temp\htw71d33cav0opbr.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" netsh advfirewall firewall add rule name="}X9'-]IF-90O-x" dir=in action=allow program="C:\Windows\proxy" enable=yes & exit
        3⤵
          PID:1112
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\proxy" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\proxy" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3800
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Program Files\proxy" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Program Files\proxy" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3264
      • C:\Users\Admin\AppData\Local\Temp\Slipgate_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\Slipgate_x64.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3252
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
          3⤵
          • Hide Artifacts: Ignore Process Interrupts
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4108
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5476
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\Slipgate', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3436
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4424
      • C:\Windows\proxy
        "C:\Windows\proxy"
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
      • C:\Program Files\Slipgate\Slipgate.exe
        "C:\Program Files\Slipgate\Slipgate.exe"
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5948
        • C:\Program Files\Slipgate\Slipgate.exe
          "C:\Program Files\Slipgate\Slipgate.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\slipgate" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,13057547911300050122,1906179914155504325,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4788
        • C:\Windows\system32\net.exe
          net session
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            3⤵
              PID:1124
          • C:\Program Files\Slipgate\Slipgate.exe
            "C:\Program Files\Slipgate\Slipgate.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\slipgate" --field-trial-handle=1704,i,13057547911300050122,1906179914155504325,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
            2⤵
            • Executes dropped EXE
            PID:2448
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /Delete /F /TN SlipgateAutoStart
            2⤵
              PID:5124
            • C:\Program Files\Slipgate\Slipgate.exe
              "C:\Program Files\Slipgate\Slipgate.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\slipgate" --app-user-model-id=com.slipgate.app --app-path="C:\Program Files\Slipgate\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786282318234992 --launch-time-ticks=707470556 --field-trial-handle=1704,i,13057547911300050122,1906179914155504325,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2584

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Winlogon Helper DLL

                1
                T1547.004

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Winlogon Helper DLL

                1
                T1547.004

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Hide Artifacts

                1
                T1564

                Ignore Process Interrupts

                1
                T1564.011

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 17KB
                • SHA256 c44c89edbfecedb5ad1159d01f8b3916a4904852f6673ce8dc24cc6952db1fa3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 16KB
                • SHA256 999266da8cb3232719befc30b685c2e7aba66c04e3aa7a98b1ee52f299b40199
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_o40synce.pqr.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o40synce.pqr.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                htw71d33cav0opbr.exe
                • Path C:\Users\Admin\AppData\Local\Temp\htw71d33cav0opbr.exe
                • Size 345KB
                • SHA256 fd7e96cebeb589e19b679f6166186ac7a801a67a442c100d7b0c81b855508c4e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICENSE.electron.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\LICENSE.electron.txt
                • Size 1KB
                • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSES.chromium.html
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\LICENSES.chromium.html
                • Size 14.6MB
                • SHA256 6965e1b04dc81a012981508299e28542abff2bc7f418071c264f0b53e0c63f34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_100_percent.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\chrome_100_percent.pak
                • Size 163KB
                • SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_200_percent.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\chrome_200_percent.pak
                • Size 252KB
                • SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                d3dcompiler_47.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\d3dcompiler_47.dll
                • Size 4.7MB
                • SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dxcompiler.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\dxcompiler.dll
                • Size 24.7MB
                • SHA256 6bf9d1e2befc53a95b7b7c374def814af0e1a21ddeb617779397e3e6ccd3b497
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dxil.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\dxil.dll
                • Size 1.4MB
                • SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ffmpeg.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\ffmpeg.dll
                • Size 2.9MB
                • SHA256 67f37568031d61040ae13022a8ec933f7d4ca7faecbb71a701f0b36489c5a330
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icudtl.dat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\icudtl.dat
                • Size 10.0MB
                • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libEGL.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\libEGL.dll
                • Size 493KB
                • SHA256 4e33a8b0632cdab12c0fab456a7d76c3c608fc9940746acd158effc493ba49c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libGLESv2.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\libGLESv2.dll
                • Size 7.7MB
                • SHA256 1a606ebb09bc8bcb64edefffe3fccecf720b557b9f23ba2aa4331b58106d9991
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                en-US.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\locales\en-US.pak
                • Size 503KB
                • SHA256 b9a2cccc13d7dac53210e37248dd70df32dbec43bd33d2c663c6290155fb751e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ru.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\locales\ru.pak
                • Size 1.0MB
                • SHA256 cc4307b19d0832b86cff809367f23346e9da41e3fc1155aa723b29542aea015b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                resources.pak
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources.pak
                • Size 5.8MB
                • SHA256 13d24097d2c5684f4a893c42beef385927d522ea94f77f470ce11270ffa22231
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICENSE
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon-info\LICENSE
                • Size 34KB
                • SHA256 0b383d5a63da644f628d99c33976ea6487ed89aaa59f0b3257992deac1171e6b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FileIconInfo.exe
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon-info\dist\FileIconInfo.exe
                • Size 9KB
                • SHA256 9e65d5a73a8d87b0125d11617ed89fc81c442102554741186609360d1540b04c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FileIconInfo.exe.config
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon-info\dist\FileIconInfo.exe.config
                • Size 189B
                • SHA256 c039ab953cfa68d229dbaf593b4f9ff8db81a61fa5ecf485fbf69eba15f837f2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                file-icon-info.js
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon-info\dist\file-icon-info.js
                • Size 534B
                • SHA256 2e4adf73c78862eab77fe9d5da5008465856b399e1974de6698dce07c3a5d8ef
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                index.js
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon-info\dist\index.js
                • Size 177B
                • SHA256 3b86a4faaac183730adb849f4ab9fd7f6ee6c441996ecb0a5aadb504d0872cf9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                package.json
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon-info\package.json
                • Size 385B
                • SHA256 ad7b1de23ae8d8e14cab4e0091d73f95607a6a1b29d11cfeeb1659ecaf3ce7a7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                file-icon
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon\file-icon
                • Size 271KB
                • SHA256 7832fc19b834c8ef797b487cbacabc5247f3a9b76d5bfe6214950f4a940bfd81
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                index.js
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon\index.js
                • Size 2KB
                • SHA256 f287670a3528abd5b1f718b1625196c5d351c581dae66dc1b09526f9fd6cc197
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon\license
                • Size 1KB
                • SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                package.json
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\app.asar.unpacked\node_modules\file-icon\package.json
                • Size 803B
                • SHA256 846c4d26236a6f79698eca21fa8a2054d4be04a6e696e8a92ba734a1f7b86ec9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                elevate.exe
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\elevate.exe
                • Size 105KB
                • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon.ico
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\icon.ico
                • Size 18KB
                • SHA256 60518b1e7b413de8eb8a00217d20637233c8fa21776dd18133ea743697d6adda
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon.png
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\icon.png
                • Size 23KB
                • SHA256 bf95d518074363eafd9924c93872df5e2f3f83f0c7c3717ca1502ca4231fbe04
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon_off.ico
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\icon_off.ico
                • Size 39KB
                • SHA256 5e1b00ef70977a9781bb7370225c06df9087052127860d740ec4fe39001e7958
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon_off.png
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\icon_off.png
                • Size 73KB
                • SHA256 6152a9e71b9cc815fa40197cde6d1f863933b2b1d60a7f602a6776d5aba996cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon_on.ico
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\icon_on.ico
                • Size 64KB
                • SHA256 970acba83cdf683f6789d87ba412f9bcd4ef4deae88f41d5850a829d4208afca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon_on.png
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\icon_on.png
                • Size 156KB
                • SHA256 90f938bdcdaeeb25f07c8ca8a1ecd339c24e5b7e1b17315a2f61ded640d718ed
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TgWsProxy_windows.exe
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\tgws\TgWsProxy_windows.exe
                • Size 12.8MB
                • SHA256 23b367be3b6033d0002b48e445f691a1b1ac445431f2684b644e4ec6ffc0c226
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinDivert.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\WinDivert.dll
                • Size 46KB
                • SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinDivert64.sys
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\WinDivert64.sys
                • Size 91KB
                • SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cygwin1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\cygwin1.dll
                • Size 2.8MB
                • SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                quic_initial_dbankcloud_ru.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\quic_initial_dbankcloud_ru.bin
                • Size 1KB
                • SHA256 f7a1c1cffc8f65bd47412b7ca5588653d21eec916bb79203c9914890a62874df
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                quic_initial_www_google_com.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\quic_initial_www_google_com.bin
                • Size 1KB
                • SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                stun.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\stun.bin
                • Size 100B
                • SHA256 9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tls_clienthello_4pda_to.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\tls_clienthello_4pda_to.bin
                • Size 284B
                • SHA256 eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tls_clienthello_max_ru.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\tls_clienthello_max_ru.bin
                • Size 664B
                • SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tls_clienthello_www_google_com.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\tls_clienthello_www_google_com.bin
                • Size 681B
                • SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                winws.exe
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\bin\winws.exe
                • Size 199KB
                • SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                general (ALT).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT).bat
                • Size 3KB
                • SHA256 79e101187467a660816b5de0ed24896e812a15bcf406370939627a659da4f8b2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT10).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT10).bat
                • Size 3KB
                • SHA256 f2c55e4dca7f3ddc2a68dc1ffb71ce847bb29176eca7860682bd369cb6956062
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT11).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT11).bat
                • Size 4KB
                • SHA256 030cd0cc306213ede6096122cf368fe21a0be8e942ce2e63551e33815fef62ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                general (ALT2).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT2).bat
                • Size 3KB
                • SHA256 85ce01bb34d69165c9d49eaac9f7c00cddaaedd971d0201700aaf62cc9acfccd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT3).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT3).bat
                • Size 3KB
                • SHA256 05e122f2f27857f4c0062a0a6d0f3861e9b62aae502396ae54b377bdbf3117a2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT4).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT4).bat
                • Size 3KB
                • SHA256 c4eaf0a1db7615be0ab35ded1bd3e6bf49170a6c8dae588931db7d9cd41a6496
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT5).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT5).bat
                • Size 2KB
                • SHA256 cd61a5253ee8b1c1a9a7beeedd9e8bad74b375c37cd070a3713a63f470c6d052
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT6).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT6).bat
                • Size 3KB
                • SHA256 608fa7b6396f23fc6addc309ea3407d5c87dac0ab5e837c00b446aa520d52470
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT7).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT7).bat
                • Size 3KB
                • SHA256 19219d6aa1948fdcc5fc303a1aceb5aa8145c7b3d2a4978a2b0ef5f311c1ee09
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT8).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT8).bat
                • Size 3KB
                • SHA256 790fb3f75d449ffb3e9d9e142da5a2f8d0a21a7f27f63955adaa038c040d55a3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (ALT9).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (ALT9).bat
                • Size 3KB
                • SHA256 e8eee2071fd21997edda9f4aa1622192de8c869c7e0674a0edea55c5e52c63e0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (FAKE TLS AUTO ALT).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (FAKE TLS AUTO ALT).bat
                • Size 3KB
                • SHA256 9ff43d7676a6a4ebcebd1c90a79f617faffdf06f43cbe7a68e6a8d086643ebff
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (FAKE TLS AUTO ALT2).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (FAKE TLS AUTO ALT2).bat
                • Size 4KB
                • SHA256 0217e7ab193bb054a10cf06493dfd6ea8131755dfd9745dd02ceae4f70758337
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                general (FAKE TLS AUTO ALT3).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (FAKE TLS AUTO ALT3).bat
                • Size 3KB
                • SHA256 7f35be595bfee1b0bb6f1504210a4f66bb709f6d298191c72a06c551ad5981a7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (FAKE TLS AUTO).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (FAKE TLS AUTO).bat
                • Size 3KB
                • SHA256 38d2bacf5f2d5fabc98c9bcfb8f742ce3bbdd618a538921f35bd9f1c2b0005f9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (SIMPLE FAKE ALT).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (SIMPLE FAKE ALT).bat
                • Size 3KB
                • SHA256 4fcb9694997a61ec2f5e41224ac226063d815fa85360aa02b87f11ee8c8a176f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (SIMPLE FAKE ALT2).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (SIMPLE FAKE ALT2).bat
                • Size 3KB
                • SHA256 ad43abb83102119d8340702be716f502398c1a16f9d713d22e2a4c20a9785be2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general (SIMPLE FAKE).bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general (SIMPLE FAKE).bat
                • Size 3KB
                • SHA256 1aee9a262bfd24f12fae0e9c0183f7accee590002ee0e0696d5196efb2dc7b2e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                general.bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\general.bat
                • Size 3KB
                • SHA256 9ada63679f8b9ae54f78b849b3cfd9e669232e3f03e758f64020832d799e9f05
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ipset-all.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\ipset-all.txt
                • Size 137B
                • SHA256 868fd74234fab450dbb4bbeb42f3ce8115cf5006581c4aac02aa10dc92cac3cb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ipset-exclude-user.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\ipset-exclude-user.txt
                • Size 18B
                • SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
                • MD5 SHA1 SHA512
                Submit Download

                ipset-exclude.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\ipset-exclude.txt
                • Size 125B
                • SHA256 36159ca57996843462cccef23b576cb461dfaa8738e2ab01807db5a6c1746725
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                list-exclude-user.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\list-exclude-user.txt
                • Size 20B
                • SHA256 9d9832f02f42e60be30f94a7a1b051342db0b1b0092c656a7bc10e730d63b234
                • MD5 SHA1 SHA512
                Submit Download

                list-exclude.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\list-exclude.txt
                • Size 1021B
                • SHA256 423603d5e2a9cd2a6c266861c19e0573b2ee7d6a9d67a89cebfc98c2bf17c813
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                list-general.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\list-general.txt
                • Size 1KB
                • SHA256 9c28eab829a960c05dbef7698192b34e060456c9c86497d73a2f3711cef274b5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                list-google.txt
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\lists\list-google.txt
                • Size 361B
                • SHA256 c5a5cc941366033e86b835b500614da1cbe5dfb49c2eaa589f5febad89661913
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                service.bat
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\resources\zapret\service.bat
                • Size 28KB
                • SHA256 005197067ae3752a99fd14863e3051a4af479b22a718b7af221f7046449568d4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snapshot_blob.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\snapshot_blob.bin
                • Size 314KB
                • SHA256 4bef4ff989a5e7f3f138b315e26e0cfea65487d2845b59508dc12b6f6e574778
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                v8_context_snapshot.bin
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\v8_context_snapshot.bin
                • Size 683KB
                • SHA256 cfa255a0c61f2926ead15f4d049d5e439d3745291058687c231cef3de56dbfc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vk_swiftshader.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\vk_swiftshader.dll
                • Size 5.3MB
                • SHA256 176adce81d9f0f1aac302806be3dbb67abda46e13355bb85c4868057c6e3a223
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vk_swiftshader_icd.json
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\vk_swiftshader_icd.json
                • Size 106B
                • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                vulkan-1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\7z-out\vulkan-1.dll
                • Size 900KB
                • SHA256 d5acc73241b46dcfd7ea5f970eab9fdc2ac5a3dc737e23d5947980972ed0a2b4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StdUtils.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\StdUtils.dll
                • Size 100KB
                • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                System.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\System.dll
                • Size 12KB
                • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                UAC.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\UAC.dll
                • Size 14KB
                • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WinShell.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\WinShell.dll
                • Size 3KB
                • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                nsDialogs.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\nsDialogs.dll
                • Size 9KB
                • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsExec.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\nsExec.dll
                • Size 6KB
                • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nsis7z.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nszB33A.tmp\nsis7z.dll
                • Size 424KB
                • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                default.acl
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Roaming\slipgate\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Roaming\slipgate\GPUCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Roaming\slipgate\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Roaming\slipgate\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\slipgate\Session Storage\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                memory/1508-159-0x000000006FD10000-0x000000006FD5C000-memory.dmp
                Download

                memory/1508-162-0x000000006FE90000-0x00000000701EB000-memory.dmp
                Download

                memory/3436-21-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-20-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-19-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-18-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-17-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-16-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-5-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/3436-7-0x0000015899A60000-0x0000015899A61000-memory.dmp
                Download

                memory/4108-136-0x00000000078D0000-0x00000000078FA000-memory.dmp
                Download

                memory/4108-125-0x0000000006340000-0x000000000635E000-memory.dmp
                Download

                memory/4108-117-0x0000000002B20000-0x0000000002B56000-memory.dmp
                Download

                memory/4108-119-0x0000000005570000-0x0000000005592000-memory.dmp
                Download

                memory/4108-120-0x0000000005CC0000-0x0000000005D26000-memory.dmp
                Download

                memory/4108-121-0x0000000005D30000-0x0000000005D96000-memory.dmp
                Download

                memory/4108-124-0x0000000005FE0000-0x000000000633B000-memory.dmp
                Download

                memory/4108-118-0x0000000005670000-0x0000000005CBA000-memory.dmp
                Download

                memory/4108-138-0x000000006FE90000-0x00000000701EB000-memory.dmp
                Download

                memory/4108-135-0x0000000007730000-0x000000000773A000-memory.dmp
                Download

                memory/4108-126-0x0000000006390000-0x00000000063DC000-memory.dmp
                Download

                memory/4108-127-0x0000000006970000-0x00000000069A6000-memory.dmp
                Download

                memory/4108-128-0x000000006FD10000-0x000000006FD5C000-memory.dmp
                Download

                memory/4108-131-0x0000000007370000-0x0000000007390000-memory.dmp
                Download

                memory/4108-132-0x0000000007610000-0x00000000076B3000-memory.dmp
                Download

                memory/4108-133-0x0000000007D40000-0x00000000083BC000-memory.dmp
                Download

                memory/4108-134-0x00000000076C0000-0x00000000076DA000-memory.dmp
                Download

                memory/4108-137-0x0000000007900000-0x0000000007924000-memory.dmp
                Download

                memory/4216-45-0x00007FFD5E7E0000-0x00007FFD5F184000-memory.dmp
                Download

                memory/4216-1-0x00007FFD5E7E0000-0x00007FFD5F184000-memory.dmp
                Download

                memory/4216-2-0x00000000000C0000-0x00000000010C0000-memory.dmp
                Download

                memory/4216-3-0x00007FFD5E7E0000-0x00007FFD5F184000-memory.dmp
                Download

                memory/4216-0-0x00007FFD5E96F000-0x00007FFD5E970000-memory.dmp
                Download

                memory/4636-25-0x0000000000210000-0x000000000026C000-memory.dmp
                Download

                memory/5476-145-0x0000000005F90000-0x00000000062EB000-memory.dmp
                Download

                memory/5476-147-0x000000006FD10000-0x000000006FD5C000-memory.dmp
                Download

                memory/5476-150-0x0000000007AD0000-0x0000000007B66000-memory.dmp
                Download

                memory/5476-151-0x0000000007A30000-0x0000000007A41000-memory.dmp
                Download