Overview

overview

10

Static

static

10

2026-09-27...op.exe

windows10-2004-x64

9

2026-09-27...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 04:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-27_78e2ed0b6f060b26ea1b75dd1b292fed_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260928-ew83ysvbna
  • SHA256 cbe216d6391502e9ee1efecdbf1c628d518844c388adb1492d738663fa4bb4e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_78e2ed0b6f060b26ea1b75dd1b292fed_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_78e2ed0b6f060b26ea1b75dd1b292fed_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2896
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies Control Panel
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2060 -prefsLen 27099 -prefMapHandle 2064 -prefMapSize 270279 -ipcHandle 2148 -initialChannelId {1fe3bd1a-4ad0-4149-96ba-61edbd6e6010} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
          • Executes dropped EXE
          PID:5204
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2544 -prefsLen 27135 -prefMapHandle 2548 -prefMapSize 270279 -ipcHandle 2556 -initialChannelId {dcfbe95f-fcf0-476a-a35e-662e9fde0b78} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:5272
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 25213 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {5fa7412c-4149-4483-aee3-2ee2154eb9f9} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5540
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27325 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {eb033b4d-7ecd-43c6-8f55-1c24f0743712} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
          4⤵
          • Executes dropped EXE
          PID:5584
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 34824 -prefMapHandle 4412 -prefMapSize 270279 -jsInitHandle 4416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4424 -initialChannelId {a78d9695-ad59-4336-b26b-ac7266ea92cd} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5828
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 35012 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {5a0d0459-8cd3-40c7-b60c-20181964c9ac} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6844
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {ce2f89f8-c43b-440e-9dbb-0938e161c4c7} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6924
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32952 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {9b5f6747-a336-4038-ab35-1d0418a6ea77} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6940
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {4cfd6187-b062-4415-9da2-088435b57b49} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6968
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {da8aafb8-e395-4896-a8a7-0883ea2488e9} -parentPid 1664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6132
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6520
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5768
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6572
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5800
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4156
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:636
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3772
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:844
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2868
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5092
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2556
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4140
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1076
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1488
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2996
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4316
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1516
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:3452
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1728
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3060
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:5052
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2648
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4564
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4728
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4336
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2336
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:2984
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2608
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:2800

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Browser Extensions

            1
            T1176

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Modify Registry

            3
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            5
            T1012

            System Information Discovery

            6
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 a3b25b53893b9746ada09959afc0d130d6438ace9e97f9abdce74003ce157cde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.5MB
            • SHA256 5db48c7aba9a5482db02e801af0b8f60d1025a0d0d91e1edea18a1454e5248cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.8MB
            • SHA256 c481ae2087f6e56801d55a2f0bdfe866a06b22652605bac5912c275cf3a544c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 ce05e2f2cbad9d5efc1f9d3aa43cd91c8571cfb818f243823d93b784f2abe69f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 6afb6d44c5e3173f8ebf90573d471dd409c6d5454ed471de65c38fd68ca1f2fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 3e722ab3868780488ffd87d7a2736faa17548bd5f1fe6cefed920d09bcd614f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.5MB
            • SHA256 ab34ffbb09c3c5d2520ca8e74e87e0d8891183237e945a79414c6e2c6b039266
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 51ecc9045c35c94ef670c75646e2aa07554e1336cd800c30ae36a311e53705b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.6MB
            • SHA256 f07f8d50319752b1a66a90ef0abd828e659d75add6f15b565c01c7b84e5361a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 f7a47dc059dde54d2e70e07f98c6d9e3f7ab0870f9aacf502d3c68519f43c9eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 ef929fab5cc5288dddcd575e4ed90e8de84cba06005ef1c774e745469496d2c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 2268b24a1c61761de9c794abc8f5abbc01574698c74a13b6e5b94379396187d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.5MB
            • SHA256 604a6a8cde7654326ec4863d72b709882517baacfdcd989d254ca86c2268e28c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 4598c49be8a1e18e20fb71a0d8e6cfa7f1e51210f8710d93d419c006209a7492
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 1b963e1a2f951ca7e70003a4a5a34f9136e1a5652ab4917fbba69ce57b2dbdeb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 742b80ee23a50b97d9a862d71eeb50820147c73b792c0ba5125ca84ed1710a4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 4c2f09982c83bf79e754b9e39d41627fd24796684ed20cf59a358f23b0005b3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 edcf3071cc08655a292781180ff63eca36a7dd1bcfa0a43f5f4be8b900c538d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 cd5e5879e5b1f9abf0a1d4763a4d4884a840424d376b127fd7dd2e57a68d9294
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 d3410ae18b3a82b3007ad01fd355ab9f60a5bda38a2362366bc0f967b5afb40a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 357b302bf07814618b6193dfb8d2cd1fe4350a38113388f2ac66992292bd2d49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 6fd3c269f9bf74cd10d504ae7c4a029a5d5561a953203e0777d963ccd3956b64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 499625a08a69c6908792eef9794374d96569880c1c35942e492f6b69b76d0e98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            firefox.exe
            • Path C:\Program Files\Mozilla Firefox\firefox.exe
            • Size 1.2MB
            • SHA256 0f76c2282417cf590e914bca0bd075d7feae18bbe1b7e7685ab12b0fa7d2c3eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 157932fe1edb6d0822b20bfdd810547174a891ff6869fac796787d65e0dbdd2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.4MB
            • SHA256 78de5393d24e3319037c6ac483a22be5a64c3e2f17733033b27008c8edaff408
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
            • Size 16KB
            • SHA256 ec9e57185e8262cf8025e6a30beb41a23bbb3686b241e4d94fe808bef362abe3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmpaddon
            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
            • Size 11KB
            • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmpaddon
            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
            • Size 502KB
            • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data.safe.tmp
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
            • Size 5KB
            • SHA256 c90d837aad1e227cd44b72896045ddd981a01a642f56edb6534701c5af3bc0a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data.safe.tmp
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
            • Size 3KB
            • SHA256 efddfb8f6057891c91e7c2b088c6f5fc3f3b02d7221ace96b01edb8c6b4861f3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data.safe.tmp
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
            • Size 7KB
            • SHA256 6e35603b8bff2007a73cb9e1fe20df76c396105eba12774fcdaa89864d9e1845
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5395ab05-9e42-4b54-ada9-159be71e60d3
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\5395ab05-9e42-4b54-ada9-159be71e60d3
            • Size 16KB
            • SHA256 0b1b0f5a3faf2960205e29019413a3b44031b57722b38da7d9708fcd6b684ddf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            657922a6-ca61-41e8-a38b-cd5de30df59a
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\657922a6-ca61-41e8-a38b-cd5de30df59a
            • Size 886B
            • SHA256 75c65134ea085729f738f26d056c444dce810278ec25210f88f5455c5987bd42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            9a64a7b5-5b10-4af5-9b59-9da2914557f3
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\9a64a7b5-5b10-4af5-9b59-9da2914557f3
            • Size 235B
            • SHA256 6539b51622f5ded7610ddf72bcda47c4ce88e61c2041cf6f116613b1058a5fee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e0fc044b-c7d1-4911-8f22-ee84273c51de
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\e0fc044b-c7d1-4911-8f22-ee84273c51de
            • Size 235B
            • SHA256 0ab5ae7dc12e3bebb82f426ec32f7de5b1fdca6fc136d3ae8a387b89373febe9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            f3358d2f-f580-46a2-928e-0796bb49aab9
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\f3358d2f-f580-46a2-928e-0796bb49aab9
            • Size 883B
            • SHA256 81e2d21fb6fe19b3e4c4ad5e0e48dedd069694c9528d97440544bee7dfcb6eb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fe7bba88-b18f-4ae6-93bf-5d7fe5abde54
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\fe7bba88-b18f-4ae6-93bf-5d7fe5abde54
            • Size 2KB
            • SHA256 b4317e2d014504ab9538d856d3bccf05710f3fe5a232b553794a195c0299ab61
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            extensions.json
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extensions.json
            • Size 16KB
            • SHA256 3f8709b4c274e98f8269db722e8be0901d9916e2da1af4df9de2bb5ec3fcc153
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gmpopenh264.dll
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
            • Size 1.1MB
            • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gmpopenh264.info
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
            • Size 116B
            • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            manifest.json
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
            • Size 1002B
            • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            widevinecdm.dll
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
            • Size 21.6MB
            • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prefs-1.js
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
            • Size 8KB
            • SHA256 4f28e0b82a542005b28c8c2af3ed5bf87c3d4e9bdc38b3ff982435c3d40b70c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prefs.js
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
            • Size 6KB
            • SHA256 b6087c9a9702ed0e401667c3ea3367bc5b92e8028fb39ff092e34e6e257319a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prefs.js
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
            • Size 6KB
            • SHA256 666690f4bf5f492c656c9f7aedd1cc31af463d3c57b1c420388ef290eed62a17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            recovery.baklz4
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionstore-backups\recovery.baklz4
            • Size 4KB
            • SHA256 488e32049243837eef36990034ab2a63f4e3016c4ad9b6e6e921fe6c58ed6eed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3870112724rsegmnoittet-es.sqlite
            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
            • Size 6.5MB
            • SHA256 99d828afc4832640620bd5fae03e88226debbfa314c5da86dbda5977854983e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 0150b577bc69494559e1c869f860edb8329d881011ac45df7161bc5fe9b085c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 a03c7dd6ecfb913c693840dcfdba153c697b1dc3aad5d47036ed3e9e4606b878
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 c39f6a232e9b82dbdfd3aa59efbf3c9579b253738d6ca0c09afbe43b97352c28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 0a684e044687a175d1a09a29201c68bbdde83c3977a3cb966983e67d7bfaf1eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 bd64752ebf4208156cb91b59403aa205d0b2f854666faef81888ea539aac9a96
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.6MB
            • SHA256 5b41a45a4fca5bd43687aff7a4cd7943ce5bc5eb4b4e6e630609100d1bb09860
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 4edacfce76f3c979235971f247d2606778acd2fa4020a5a3f77b3baa495eb48e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 7dab31a3283129f3fafb7c0af0c474ea5c5ed917521a570b1c9f564ab38dfc79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 6e325e1f6d3bc0ded22e48f4a4e8ae80515f3f87535d8cdb293c08a3cf8b5fd0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 912433baf412b4bcb7f1a67ce0cb4d356434df82e7a97f9124b5f7639d7ea8f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 4725fde6e35cbc5351016f5d1537d7716552d0ea42c365925ede2ed3881be4a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 196dd5de7d55445c608947d988d0934adbcc211b6a88a1f4734e1b5c276c65f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 1c1faffa93f7c74223d71ee7e18afa7f2c5f5d69ec39c86880a381199a42a768
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.4MB
            • SHA256 ca7da9721cbfa821b332f5c3ce644090f326794ce415f3fb1b19b0abacf4e57d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 1e9497d91a525cb96fc663195f5f4871fbb4989821c48a05092813f3cb35c5be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 f89f8a6a247ed3980cffce35c67339116c5251f6e9805071a3151d1b9a81e8ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 bf2a3aa615c41ad0ed772a190ca6cdb1441d3df8179fbfd7f8ca3a6d823e8c1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 5298f479d5b7491ce9b1873775eb0a7d43db28411b17bf37248674ad2db867ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 00c70943c9dbde6375592a31ed313701ad93256d630bab6032f5c267b836036a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 0209906259ad10a19eb75f5a118178d4438b655e4a9d7ee6785936e75a37a3c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.3MB
            • SHA256 cc749d9934e6874cf706b451082c86ee8438cc21700db691446506220b014c85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/636-24-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/636-23-0x0000000140000000-0x0000000140200000-memory.dmp
            Download

            memory/636-15-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/844-117-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/844-28-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/868-8-0x0000000000400000-0x0000000000A64000-memory.dmp
            Download

            memory/868-70-0x0000000000400000-0x0000000000A64000-memory.dmp
            Download

            memory/868-5-0x0000000000EB0000-0x0000000000F16000-memory.dmp
            Download

            memory/868-0-0x0000000000EB0000-0x0000000000F16000-memory.dmp
            Download

            memory/1076-73-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/1076-79-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/1076-153-0x0000000140000000-0x0000000140226000-memory.dmp
            Download

            memory/1076-82-0x0000000140000000-0x0000000140226000-memory.dmp
            Download

            memory/1488-84-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/1488-90-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/1488-93-0x0000000140000000-0x0000000140202000-memory.dmp
            Download

            memory/1488-156-0x0000000140000000-0x0000000140202000-memory.dmp
            Download

            memory/1516-169-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1516-362-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1516-113-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1728-130-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1728-126-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1728-120-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1728-335-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/2336-162-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2336-385-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2556-62-0x0000000140000000-0x000000014022C000-memory.dmp
            Download

            memory/2556-52-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/2556-58-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/2556-66-0x0000000140000000-0x000000014022C000-memory.dmp
            Download

            memory/2556-64-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/2800-388-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-370-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-369-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-376-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-377-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-378-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-366-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-401-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-400-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-399-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-398-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-397-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-396-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-395-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-394-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-393-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-392-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-391-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-390-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-389-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-386-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-375-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-387-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-410-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-409-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-408-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-407-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-406-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-405-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-404-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-403-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-367-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-368-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-365-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-364-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-363-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-374-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-373-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-371-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2800-372-0x000001E56E4A0000-0x000001E56E4B0000-memory.dmp
            Download

            memory/2868-37-0x0000000000C30000-0x0000000000C90000-memory.dmp
            Download

            memory/2868-128-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/2868-31-0x0000000000C30000-0x0000000000C90000-memory.dmp
            Download

            memory/2868-40-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/2984-402-0x0000000140000000-0x000000014021D000-memory.dmp
            Download

            memory/2984-166-0x0000000140000000-0x000000014021D000-memory.dmp
            Download

            memory/2996-104-0x0000000000400000-0x00000000005EE000-memory.dmp
            Download

            memory/2996-100-0x00000000005F0000-0x0000000000656000-memory.dmp
            Download

            memory/2996-161-0x0000000000400000-0x00000000005EE000-memory.dmp
            Download

            memory/2996-95-0x00000000005F0000-0x0000000000656000-memory.dmp
            Download

            memory/3060-358-0x0000000140000000-0x0000000140259000-memory.dmp
            Download

            memory/3060-143-0x0000000140000000-0x0000000140259000-memory.dmp
            Download

            memory/3060-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/3060-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/3452-118-0x0000000140000000-0x00000001401ED000-memory.dmp
            Download

            memory/3452-309-0x0000000140000000-0x00000001401ED000-memory.dmp
            Download

            memory/4140-71-0x0000000140000000-0x0000000140210000-memory.dmp
            Download

            memory/4156-12-0x0000000140000000-0x0000000140201000-memory.dmp
            Download

            memory/4156-103-0x0000000140000000-0x0000000140201000-memory.dmp
            Download

            memory/4316-110-0x0000000140000000-0x00000001401EC000-memory.dmp
            Download

            memory/4316-165-0x0000000140000000-0x00000001401EC000-memory.dmp
            Download

            memory/4336-157-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4336-380-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4540-360-0x000000000CD70000-0x000000000CD78000-memory.dmp
            Download

            memory/4540-179-0x0000000001770000-0x0000000001780000-memory.dmp
            Download

            memory/4540-419-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4540-170-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4540-195-0x0000000001A20000-0x0000000001A30000-memory.dmp
            Download

            memory/4540-215-0x0000000009E60000-0x0000000009E68000-memory.dmp
            Download

            memory/4564-148-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4564-150-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4728-154-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4728-379-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/5052-359-0x0000000140000000-0x0000000140239000-memory.dmp
            Download

            memory/5052-146-0x0000000140000000-0x0000000140239000-memory.dmp
            Download

            memory/5092-42-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/5092-129-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5092-61-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5092-48-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download