Overview

overview

10

Static

static

3

2026-09-29...ar.exe

windows10-2004-x64

10

2026-09-29...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 22:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
  • Size 21.5MB
  • Sample260930-2hn7ystdma
  • SHA256 ee751ee890eb57fbdb9cd2079e9d27dfec97ac4576eaebc3e255e692a8756b06
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 8 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 18 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 28 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 56 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Users\Admin\AppData\Local\Temp\is-H1B4D.tmp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-H1B4D.tmp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp" /SL5="$E016E,21124305,189952,C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:5016
    • C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe
      "C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Users\Admin\AppData\Local\Temp\._cache_chromehelper.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_chromehelper.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4200
        • C:\Users\Admin\AppData\Local\Temp\is-BENGC.tmp\._cache_chromehelper.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-BENGC.tmp\._cache_chromehelper.tmp" /SL5="$C025C,21124305,189952,C:\Users\Admin\AppData\Local\Temp\._cache_chromehelper.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5212
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C schtasks /QUERY /TN "Google Chrome Helper Update"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /QUERY /TN "Google Chrome Helper Update"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3040
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C schtasks /CREATE /XML "C:\Users\Admin\AppData\Local\Temp\Pga.xml" /TN "Google Chrome Helper Update"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5560
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /XML "C:\Users\Admin\AppData\Local\Temp\Pga.xml" /TN "Google Chrome Helper Update"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:6020
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6EA87CAA66163D8B395B6F0A56830153
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1224
    • C:\Windows\Installer\MSI2B1E.tmp
      "C:\Windows\Installer\MSI2B1E.tmp" install "C:\Program Files (x86)\Radmin VPN\Driver.1.1\NetMP60.inf" "C:\Program Files (x86)\Radmin VPN\Driver.1.0\NetMP60.inf" ad_InstallDriver_64 ""
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A8BE4FC72915CB1D40DE5F6618FC09B7 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Radmin VPN Control Service" dir=in action=allow program="C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe" enable=yes profile=any edge=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:5292
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Radmin VPN icmpv4" action=allow enable=yes dir=in profile=any remoteip=26.0.0.0/8 protocol=icmpv4
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4588
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "c:\program files (x86)\radmin vpn\driver.1.1\netmp60.inf" "9" "42f731a47" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\radmin vpn\driver.1.1"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:828
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c36c271bc64eefc9:RVpnNetMP.ndi:15.39.54.8:{b06d84d1-af78-41ec-a5b9-3cce676528b2}\rvnetmp60," "42f731a47" "0000000000000148"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4336
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /minimized
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1748
  • C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe
    "C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe" /service
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface set interface name="Ethernet 2" newname="Radmin VPN"
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3200
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface set interface "Radmin VPN" ENABLE
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3956
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface ipv4 set interface interface="Radmin VPN" metric=1
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4596
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface ip delete route prefix=0.0.0.0/0 interface="Radmin VPN" nexthop=26.0.0.1
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3480
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface ip add route prefix=0.0.0.0/0 interface="Radmin VPN" nexthop=26.0.0.1 publish=Yes metric=9256
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4676
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface ip add address name="Radmin VPN" addr=26.141.67.242 mask=255.0.0.0 gateway=26.0.0.1 gwmetric=9256
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2424
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe interface ipv6 add address interface="Radmin VPN" address=fdfd::1a8d:43f2
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:6124
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /show
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4884
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /show
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1120
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:5324
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
    1⤵
    • Modifies security service
    PID:1756
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /show
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1140
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:6032
  • C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe
    "C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5584
    • C:\Windows\SysWOW64\._cache_chromehelper.exe
      "C:\Windows\system32\._cache_chromehelper.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6060
      • C:\Users\Admin\AppData\Local\Temp\is-54NT2.tmp\._cache_chromehelper.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-54NT2.tmp\._cache_chromehelper.tmp" /SL5="$601DA,21124305,189952,C:\Windows\SysWOW64\._cache_chromehelper.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4184
  • C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
    "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /show
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3428
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:6124

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Modify Registry

        2
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        5
        T1012

        System Information Discovery

        6
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e590a0b.rbs
        • Path C:\Config.Msi\e590a0b.rbs
        • Size 882KB
        • SHA256 5cd1dd9e8aa63ce5ca3b3315652807a8035d90fe4d3f6f1c8bcce2c14056bad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chromehelper.exe
        • Path C:\Program Files (x86)\Google Chrome Helper\chromehelper.exe
        • Size 21.5MB
        • SHA256 ee751ee890eb57fbdb9cd2079e9d27dfec97ac4576eaebc3e255e692a8756b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NetMP60.inf
        • Path C:\Program Files (x86)\Radmin VPN\Driver.1.1\NetMP60.inf
        • Size 5KB
        • SHA256 ef6769520c94a3b5885458cd19696b45cf79010e9757729b2049ba6782fecfd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files (x86)\Radmin VPN\Qt5Core.dll
        • Size 5.7MB
        • SHA256 c59a08385bbcb2a365eaef65e0fcd0e7c348be033871472a79ea0ffaf953035f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files (x86)\Radmin VPN\Qt5Gui.dll
        • Size 6.4MB
        • SHA256 d2bfd11de25ff2dfbb25fc36b3b719ba0a265d692fb8cde36232bac15e1dbe1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Network.dll
        • Path C:\Program Files (x86)\Radmin VPN\Qt5Network.dll
        • Size 1.1MB
        • SHA256 56a9f187e5c5b34db814a3c6d361b2135a1034582cdfc5166aba18519d44e986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Svg.dll
        • Path C:\Program Files (x86)\Radmin VPN\Qt5Svg.dll
        • Size 371KB
        • SHA256 e4265fde83177c7e43674a057b219eea7ec95a2e42a82a7a77f4b901481223e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Program Files (x86)\Radmin VPN\Qt5Widgets.dll
        • Size 5.5MB
        • SHA256 14733381ecdeaf6370eea31f5df655d2354dcc67ad1866c9170a5884efe84909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5WinExtras.dll
        • Path C:\Program Files (x86)\Radmin VPN\Qt5WinExtras.dll
        • Size 486KB
        • SHA256 b9d95d74851b475f63852883ce31855f0b214302eaa3b49cb69ef347db2f5646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvControlSvc.exe
        • Path C:\Program Files (x86)\Radmin VPN\RvControlSvc.exe
        • Size 1.0MB
        • SHA256 36baea67e6c627f24ba02976a0236ded5224681ff7dab6f3a1eede73bd61ced6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvDownloader.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvDownloader.dll
        • Size 357KB
        • SHA256 98123fc5750c7c1d50578e7236bd7065d465927a427985df0f735303c97cd4a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvEnetConnect.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvEnetConnect.dll
        • Size 413KB
        • SHA256 62d6737b22163a65c0ec1ad1acbe3d5501865aac15a9a7a872ddfb2b612e29e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvROLClient.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvROLClient.dll
        • Size 1.3MB
        • SHA256 e5c5c7774f9769d920a3ae78787c64d95ded6bfd39c452f718e291106bf48276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvRolUpdater.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvRolUpdater.dll
        • Size 478KB
        • SHA256 8ef017cc7eeba8cf34c33bd59ea696196ac0f23ac903ccfe5d1a5061dd7e711a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvRvpnGui.exe
        • Path C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe
        • Size 2.0MB
        • SHA256 4cfb334d8196cd378069b8fe069cd3be36bd3f6e0195192abe0dec6135fa77ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvRvpnGui_en_us.qm
        • Path C:\Program Files (x86)\Radmin VPN\RvRvpnGui_en_us.qm
        • Size 21KB
        • SHA256 48b939cc90beec0478c7856f699f707017d0a00a00ca62042b26e7f57331373c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvTCPConnect.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvTCPConnect.dll
        • Size 413KB
        • SHA256 64ffa460c99e554547b12e1488e76b899513467ef3051391bae4da93c2b18de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvTRSConnect.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvTRSConnect.dll
        • Size 695KB
        • SHA256 a6ea92721282365ab6c31347732a0efe864ddd94e743e9b4f2a6cf11000892a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvUESClient.dll
        • Path C:\Program Files (x86)\Radmin VPN\RvUESClient.dll
        • Size 356KB
        • SHA256 d39aed90973525c09f707f6b12eb699aef25cc6f63c3374f6bc7e75411f49f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qgif.dll
        • Path C:\Program Files (x86)\Radmin VPN\imageformats\qgif.dll
        • Size 40KB
        • SHA256 b49c00a14a146d53c912f3a52024241079202e8ac54fbbc6684a2fa8e5bd3157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qico.dll
        • Path C:\Program Files (x86)\Radmin VPN\imageformats\qico.dll
        • Size 39KB
        • SHA256 796d9587583a430e98212597cc16fd831abaad52f899e515a77b4e629acc1fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvg.dll
        • Path C:\Program Files (x86)\Radmin VPN\imageformats\qsvg.dll
        • Size 30KB
        • SHA256 e4767f946eb6d0fe76bcecdd56df5f215fdca17ef35ec1e5dab00c09b14b407f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files (x86)\Radmin VPN\msvcp140.dll
        • Size 438KB
        • SHA256 2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Program Files (x86)\Radmin VPN\platforms\qwindows.dll
        • Size 1.3MB
        • SHA256 85f6b7d3dba47289f6109169db3212abec22ee842b9bd78d70798e97db4aecf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shelper.dll
        • Path C:\Program Files (x86)\Radmin VPN\shelper.dll
        • Size 726KB
        • SHA256 d89daf6bcd5cafa3c7f6173f835ccf045baf8e7134f868819db6fd7615959ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Program Files (x86)\Radmin VPN\vcruntime140.dll
        • Size 78KB
        • SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~WRS{D2A02304-4C21-4731-A5F2-41DBCCD20039}.tmp
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D2A02304-4C21-4731-A5F2-41DBCCD20039}.tmp
        • Size 1024B
        • SHA256 fe68555ec0807bb5224542a59a1788ea84ac74246f0bb4faf139776539619782
        • MD5 SHA1 SHA512
        Submit Download

        ._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.exe
        • Size 20.7MB
        • SHA256 1f4d6ca8cc9230c4b3c87ec4babbdc3749c471b3065d850058abb2258cd8c79f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        156A5E00
        • Path C:\Users\Admin\AppData\Local\Temp\156A5E00
        • Size 17KB
        • SHA256 3ab10ef48fc80e6be7d1659cc77974f07b260aaf499cc0c9b87c60549afb90c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        414A5E00
        • Path C:\Users\Admin\AppData\Local\Temp\414A5E00
        • Size 18KB
        • SHA256 91e17db44b7bbc2e9479aa4cec17bf999d19d0e197afd752c73ffb6e26f157d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        503A5E00
        • Path C:\Users\Admin\AppData\Local\Temp\503A5E00
        • Size 20KB
        • SHA256 99997657ebf6e7eb767ec3734d9c1e53f833c47dd0ecc3c5b6f84531c1b8c815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        6B1A5E00
        • Path C:\Users\Admin\AppData\Local\Temp\6B1A5E00
        • Size 21KB
        • SHA256 44bfd6e0f2bd8b2a9f8291840fd1110fb3efa10a98ee62a63c2e7498a1ec01c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BA4A5E00
        • Path C:\Users\Admin\AppData\Local\Temp\BA4A5E00
        • Size 20KB
        • SHA256 3583ca9c1b50ae81c0072101176565b9d61301e42c10c4fd508c99e6ca16f898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C54A5E00
        • Path C:\Users\Admin\AppData\Local\Temp\C54A5E00
        • Size 23KB
        • SHA256 7eb5d91775f706d5bc583c99ecb253122328531c996e33bfcd2e2203399697a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWnpF.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\PWnpF.xlsm
        • Size 18KB
        • SHA256 2a0124654437b5b6503d6270406f46eacb47ce9737043c09075a308408a5c97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auhPl.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\auhPl.xlsm
        • Size 20KB
        • SHA256 62960e389309302081d028a51bff4b092ca84fd97d784a9a0f438072118fa8e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-H1B4D.tmp\._cache_2026-09-29_2f756d70d50fce97acac2e81d2bc27a3_amadey_darkgate_datper_elex_gcleaner_icedid_luca-stealer_njrat_remcos_vidar.tmp
        • Size 1.2MB
        • SHA256 421cb7e48e3063d927eefe28940e119fb1309a3990bc7325c7f7052a2b286a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RadminVPN_1.3.4568.3.msi
        • Path C:\Users\Admin\AppData\Local\Temp\is-K0UU5.tmp\RadminVPN_1.3.4568.3.msi
        • Size 19.8MB
        • SHA256 a846e0eca7af1e257735daa568046235c88632c7b40f25594f2d8b455dfdd1ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Rvis_install_dll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-K0UU5.tmp\Rvis_install_dll.dll
        • Size 361KB
        • SHA256 ec8d9949fe10f84f7950b498ddca87e6c07189158cd89bddca0c7e2d69289893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _shfoldr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-P6687.tmp\_isetup\_shfoldr.dll
        • Size 22KB
        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pzUAa.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\pzUAa.xlsm
        • Size 2.1MB
        • SHA256 aff5077857f384c0620f494c360534ba329f84d8f872238580b1790a7e00de18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tGkXX.docm
        • Path C:\Users\Admin\AppData\Local\Temp\tGkXX.docm
        • Size 25KB
        • SHA256 633276e7f7cfc871ff77c2bb8249382f3933f81f7361b799205f59e569a34959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~$PWnpF.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\~$PWnpF.xlsm
        • Size 165B
        • SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
        • MD5 SHA1 SHA512
        Submit Download

        ~WRD0000.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp
        • Size 25KB
        • SHA256 2622bb36dbd697940361fadb2d1a8d52275d319ab10ba564367ac0ed5c68cb66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~WRD0002.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~WRD0002.tmp
        • Size 29KB
        • SHA256 a70fa35fae10339bb3d2b32b781b842b4641a3c3113fec9c3257ce7b20c79800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~WRD0004.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~WRD0004.tmp
        • Size 26KB
        • SHA256 b2de183ea07cff14ebde52139a77a9137e0086c0bae84e77509e7e88f52e8df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~WRD2062.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~WRD2062.tmp
        • Size 29KB
        • SHA256 dc949f6e3957210cd92f8447751017df92f8a98941c36096cab9d7fc4ac92344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~WRD2867.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~WRD2867.tmp
        • Size 26KB
        • SHA256 f36fd1d8b6b364d6aee6f3acf3fec886f00e68edc643e4a1e533245159b5368e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~WRD2996.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~WRD2996.tmp
        • Size 26KB
        • SHA256 11073b55f95a3048c7c4a1eed5ffddb2007675728a7dd7b1b23888671f46a610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        APASixthEditionOfficeOnline.xsl
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl
        • Size 325KB
        • SHA256 9095fe60c9f5a135dfc22b23082574fbf2f223bd3551e75456f57787abc5797b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CHICAGO.XSL
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL
        • Size 290KB
        • SHA256 787d1cbf076902b2568e8cff1245e5fbeba6aad84240a54c4f9957084b93f90d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GB.XSL
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL
        • Size 262KB
        • SHA256 8535282a6e53fa4f307375bcee99dd073a4e2e04faf8841e51e1aa0ee351a670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GostName.XSL
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL
        • Size 250KB
        • SHA256 40bacd32db58799fa95b4707588adea1c9065cd804712b69b55ddd332c037d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GostTitle.XSL
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL
        • Size 245KB
        • SHA256 dc7160c2fe5939e82bfeee180c1da8176c4914c034cae8938ed6c9f7a9144f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HarvardAnglia2008OfficeOnline.xsl
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl
        • Size 278KB
        • SHA256 bcfb2ef3d37f7dafcb9ff4d92885c5f87b4bec7a3045bc7208460dae7dabae31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEEE2006OfficeOnline.xsl
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl
        • Size 287KB
        • SHA256 9970654851826c920261d52f8536b1305f7e582c7a2e892bac344a95f909fe63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISO690Nmerical.XSL
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL
        • Size 212KB
        • SHA256 a343d61bab2f25d138bdcc57d33c4a83fd494a54eaf3df0f539e3b51cfe011f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MLASeventhEditionOfficeOnline.xsl
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl
        • Size 249KB
        • SHA256 a69368be9ac843b088d739f1573007e634d1068db0ad9937a95fe7a0690c05e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TURABIAN.XSL
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL
        • Size 336KB
        • SHA256 5b7a52dfaa9c3e9e340e081178b54e827ed591ac27dc098c3985c94bde5cabe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
        • Size 443B
        • SHA256 05677b4d4c5472176a4b3b5c1167d179c5bb95d92f73f31b2db9efbbf1e81240
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
        • Size 446B
        • SHA256 593a19e42eef77a6e4d6d32cc1f34bfc9aec1beb5d5ba0e62eb81ebf2e4eabfd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
        • Size 442B
        • SHA256 a452651b8dcb495a45abd8a8c05cbc4b1e878734640e0c64740ba5dd89952252
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI2B1E.tmp
        • Path C:\Windows\Installer\MSI2B1E.tmp
        • Size 495KB
        • SHA256 a098115e03a542a19459f252ddc7dabf733e9dd612585c71db978d9b0f8cf984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3205.tmp
        • Path C:\Windows\Installer\MSI3205.tmp
        • Size 366KB
        • SHA256 8a96198043910d6673de6626b814b932f424f954f3d8b4e9e1b5c5f08549096c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RvNetMP60.sys
        • Path \??\c:\PROGRA~2\RADMIN~1\DRIVER~1.1\RvNetMP60.sys
        • Size 56KB
        • SHA256 88765957ac41e3f00f1fd98393342ea40ddcc05952aba418e099d866296c1bf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NetMP60.cat
        • Path \??\c:\program files (x86)\radmin vpn\driver.1.1\NetMP60.cat
        • Size 10KB
        • SHA256 6ba444527b66803b9fa43b80509788c761fa18b52360e27b74cc2e8a1c115b3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/968-484-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/968-688-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/968-1727-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/968-1728-0x00000000001C0000-0x00000000001CB000-memory.dmp
        Download

        memory/968-1756-0x00000000001C0000-0x00000000001CB000-memory.dmp
        Download

        memory/968-1755-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/968-953-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/968-1759-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/968-1760-0x00000000001C0000-0x00000000001CB000-memory.dmp
        Download

        memory/2232-62-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/2232-392-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/2232-86-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/4184-570-0x0000000000400000-0x000000000053C000-memory.dmp
        Download

        memory/4200-470-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/4200-483-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/4540-411-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/4540-0-0x00000000035F0000-0x00000000035F1000-memory.dmp
        Download

        memory/4540-78-0x00000000035F0000-0x00000000035F1000-memory.dmp
        Download

        memory/4540-85-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/4540-1-0x000000000048E000-0x000000000048F000-memory.dmp
        Download

        memory/5016-68-0x0000000000400000-0x000000000053C000-memory.dmp
        Download

        memory/5016-87-0x0000000000400000-0x000000000053C000-memory.dmp
        Download

        memory/5016-391-0x0000000000400000-0x000000000053C000-memory.dmp
        Download

        memory/5212-482-0x0000000000400000-0x000000000053C000-memory.dmp
        Download

        memory/5584-557-0x0000000000400000-0x0000000001984000-memory.dmp
        Download

        memory/6032-492-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6032-495-0x00007FFC80E30000-0x00007FFC80E40000-memory.dmp
        Download

        memory/6032-498-0x00007FFC80E30000-0x00007FFC80E40000-memory.dmp
        Download

        memory/6032-493-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6032-491-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6032-494-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6032-490-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6060-555-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/6060-571-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/6124-1745-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6124-1744-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6124-1742-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download

        memory/6124-1743-0x00007FFC83210000-0x00007FFC83220000-memory.dmp
        Download