Overview

overview

10

Static

static

3

New Client.exe

windows7-x64

10

New Client.exe

windows10-1703-x64

10

New Client.exe

windows10-2004-x64

10

New Client.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1800s
  • max time network
    1804s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24/02/2024, 03:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Client.exe
  • Size 188KB
  • Sample240224-dxslxsff85
  • SHA256 13fde5c8aeb2fe2335dcb803a1a31a404e2f65e990d2a728a0df681ef832b616
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njratantiviruspersistenceransomwaretrojan

Malware Config

Extracted

Family

  • njrat

Version

  • Platinum

Botnet

  • AntiVirus

C2

  • 127.0.0.1:38277

Mutex

  • Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Drops startup file 3 IoCs
  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3724
    • C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4460
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f im explorer.exe
      2⤵
      • Kills process with taskkill
      PID:3376
    • C:\Users\Admin\AppData\Local\Temp\68e808a32a7445e081481e1a576a6eea.exe
      "C:\Users\Admin\AppData\Local\Temp\68e808a32a7445e081481e1a576a6eea.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4436
      • C:\Users\Admin\AppData\Local\Temp\Ention.exe
        "C:\Users\Admin\AppData\Local\Temp\Ention.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ.txt
          4⤵
            PID:876
        • C:\Users\Admin\AppData\Local\Temp\Locker.exe
          "C:\Users\Admin\AppData\Local\Temp\Locker.exe"
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          PID:4124
      • C:\Users\Admin\AppData\Local\Temp\fe70bfde50bf46b298d0a63350d2cf4f.exe
        "C:\Users\Admin\AppData\Local\Temp\fe70bfde50bf46b298d0a63350d2cf4f.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Users\Admin\AppData\Local\Temp\Ention.exe
          "C:\Users\Admin\AppData\Local\Temp\Ention.exe"
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1536
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ.txt
            4⤵
              PID:4492
        • C:\Users\Admin\AppData\Local\Temp\1c174b145c8e4091a5774f9441cbf620.exe
          "C:\Users\Admin\AppData\Local\Temp\1c174b145c8e4091a5774f9441cbf620.exe"
          2⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          PID:4696
        • C:\Users\Admin\AppData\Local\Temp\e88f17b8ff0a4f2ebbd6d3f2551f6ef4.exe
          "C:\Users\Admin\AppData\Local\Temp\e88f17b8ff0a4f2ebbd6d3f2551f6ef4.exe"
          2⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          PID:4872
        • C:\Users\Admin\AppData\Local\Temp\7ae6b7a89ffa41948a832202917a02fd.exe
          "C:\Users\Admin\AppData\Local\Temp\7ae6b7a89ffa41948a832202917a02fd.exe"
          2⤵
          • Executes dropped EXE
          PID:760
        • C:\Users\Admin\AppData\Local\Temp\5d71b00b8a674bc4bb44882ec07efcce.exe
          "C:\Users\Admin\AppData\Local\Temp\5d71b00b8a674bc4bb44882ec07efcce.exe"
          2⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3656
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loll.VBS"
            3⤵
            • Enumerates connected drives
            • Modifies registry class
            PID:2712
        • C:\Users\Admin\AppData\Local\Temp\aa99e63a512a4219a7e849a1b04a46b1.exe
          "C:\Users\Admin\AppData\Local\Temp\aa99e63a512a4219a7e849a1b04a46b1.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3664
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A2F3.tmp\A2F4.tmp\A2F5.bat C:\Users\Admin\AppData\Local\Temp\aa99e63a512a4219a7e849a1b04a46b1.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/lFwy2c-5Rwg
              4⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1444
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff6c23cb8,0x7ffff6c23cc8,0x7ffff6c23cd8
                5⤵
                  PID:4452
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
                  5⤵
                    PID:680
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1756
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
                    5⤵
                      PID:4856
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                      5⤵
                        PID:4756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
                        5⤵
                          PID:996
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
                          5⤵
                            PID:4680
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
                            5⤵
                              PID:1472
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4036 /prefetch:8
                              5⤵
                                PID:4500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                                5⤵
                                  PID:1360
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
                                  5⤵
                                    PID:2680
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,16550767142821304254,2483594917616841752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1892
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of WriteProcessMemory
                            PID:1384
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:244
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3876
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3372
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4992
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2724
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1932
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1148
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1096
                          • C:\Windows\system32\AUDIODG.EXE
                            C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D0
                            1⤵
                              PID:124
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4468
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:560
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:224

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 6KB
                                        • SHA256 d1d3c32546a06ef36a4317a11a8b5b8a1034063bf1d9ea4735abfb9702740b14
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 6KB
                                        • SHA256 19494da60cdd103a2e4c05d105825f6212b6245471d23e9b12ee5382b52f687a
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        index.txt
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                        • Size 146B
                                        • SHA256 93a80995599d5798cc8959005531e2fe945d1f7ab8068d85b34c32087c3fb2dc
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        index.txt
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                        • Size 82B
                                        • SHA256 583a8a51cf921a87d398d58663a9a7cdb45951b38afd1f89a2640940b21a1440
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        index.txt~RFe72adc1.TMP
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe72adc1.TMP
                                        • Size 89B
                                        • SHA256 872de3ade2da941fa404f099421202dfa7bdc55df94d514ce70b55079c84c4b5
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 11KB
                                        • SHA256 c8cfc19e73653b63d2998ff132e0811502f7b5b700a75453a0327db36c8034e1
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        CurrentDatabase_400.wmdb
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                        • Size 896KB
                                        • SHA256 d8974f13e71a5cf5b893e271b1b2e23b75e0a7da7fc050439790231b303aa80e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        WMSDKNS.XML
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                        • Size 9KB
                                        • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        1c174b145c8e4091a5774f9441cbf620.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\1c174b145c8e4091a5774f9441cbf620.exe
                                        • Size 653KB
                                        • SHA256 42c145d05f5a3d20a4df748d488e32f986ef0bbd370dd086b6f431e00a5efb14
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        5d71b00b8a674bc4bb44882ec07efcce.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\5d71b00b8a674bc4bb44882ec07efcce.exe
                                        • Size 417KB
                                        • SHA256 c0a140b3a484617da0127159e7cce955d6749019dffaae2e1c3b0ed65ad8b9b4
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        68e808a32a7445e081481e1a576a6eea.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\68e808a32a7445e081481e1a576a6eea.exe
                                        • Size 6.2MB
                                        • SHA256 9755b75a23a85e19954802f757b2f86e5dde5bd661e7dbed2141d89090da924e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        7ae6b7a89ffa41948a832202917a02fd.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\7ae6b7a89ffa41948a832202917a02fd.exe
                                        • Size 6.3MB
                                        • SHA256 259addf9bc00c8ba891377c977a764b9a57422b8d803b41be0d431013fc46ce0
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Ention.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
                                        • Size 3.0MB
                                        • SHA256 1dc93a7e26d97c3ab84b04b4523aafcc7128808d2317899b7042df9121a175d7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Ention.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
                                        • Size 1.8MB
                                        • SHA256 de6565f29a91aa40f8c6b52f8a3310299a9156691333297170f4c54dbecaa6ca
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Ention.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
                                        • Size 1.6MB
                                        • SHA256 e11a7fa7fd54c5a494066c77ac66dd85937fd8bad4e8ed5722cb04a05d5e84e6
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Ention.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
                                        • Size 3.2MB
                                        • SHA256 c7d66a8f9672bafaefd09e92e3167d7caac525634e08b0cb63a861417cad5e45
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Ention.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
                                        • Size 1.3MB
                                        • SHA256 eecb93b566d7d66fa01085b9c5b5c67ccd2417274a77b912268f4cd958fcb27f
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Locker.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\Locker.exe
                                        • Size 793KB
                                        • SHA256 7a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        aa99e63a512a4219a7e849a1b04a46b1.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\aa99e63a512a4219a7e849a1b04a46b1.exe
                                        • Size 86KB
                                        • SHA256 7189f55b3d5153bd190991dc5e3349755e300fd20b0e52a34e57579e20308888
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        wl.jpg
                                        • Path C:\Users\Admin\AppData\Local\Temp\wl.jpg
                                        • Size 138KB
                                        • SHA256 b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Новый текстовый документ.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ.txt
                                        • Size 331B
                                        • SHA256 3f93a8b1cdb1a748236e3d4230bd856abefa8d3660b691de89c5fc4e249a0fed
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        TranscodedWallpaper
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                        • Size 150KB
                                        • SHA256 b31d23ec950a037f524b951726cf597b1f41a40ea9063bf63c41e3161367ec00
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.AddClear.dll
                                        • Path C:\Users\Admin\Desktop\Fixed.AddClear.dll
                                        • Size 675KB
                                        • SHA256 54ca08a589509219e065d2d6dfff9436f84595a914d7e8aa9c803def6eb2f248
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.AddDisable.mpeg3
                                        • Path C:\Users\Admin\Desktop\Fixed.AddDisable.mpeg3
                                        • Size 602KB
                                        • SHA256 8d6027903c2fba80bd65c5424f462dd7ecee45ebbcfe538c926d55fb8a716ec5
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.ConvertHide.shtml
                                        • Path C:\Users\Admin\Desktop\Fixed.ConvertHide.shtml
                                        • Size 307KB
                                        • SHA256 de7c9385ff241607e006020ef9c63239bc026fd2851f77e420495a9201dceda4
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.ConvertToInstall.cmd
                                        • Path C:\Users\Admin\Desktop\Fixed.ConvertToInstall.cmd
                                        • Size 872KB
                                        • SHA256 3e3a499a9f801736f7ecae871e8113f17a92d5252c13b983fceefa9d1ffc9139
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.DismountSplit.WTV
                                        • Path C:\Users\Admin\Desktop\Fixed.DismountSplit.WTV
                                        • Size 380KB
                                        • SHA256 b5a3f916172b0d3a20a9abd7be7fd78a6bf11891f2d31a5897f58b9b343b3f58
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.FormatConvertTo.html
                                        • Path C:\Users\Admin\Desktop\Fixed.FormatConvertTo.html
                                        • Size 724KB
                                        • SHA256 b344780854ba6907a5bb21b3117c441e9258b9a7c5a3f79b540a03617c34c308
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.FormatTest.htm
                                        • Path C:\Users\Admin\Desktop\Fixed.FormatTest.htm
                                        • Size 577KB
                                        • SHA256 8ac7978338eb3109a6cd63a687dbab295972f1a6a122f1dc6a4c31e89effc158
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.GetDismount.ppsm
                                        • Path C:\Users\Admin\Desktop\Fixed.GetDismount.ppsm
                                        • Size 454KB
                                        • SHA256 59044e1113d952903407a90bbf92e9ad14533d34b56dfc249169896e0e7e1ca6
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.InstallExpand.wdp
                                        • Path C:\Users\Admin\Desktop\Fixed.InstallExpand.wdp
                                        • Size 1.2MB
                                        • SHA256 1a5fc83842ceee219e4b0f1dbf497d29728547beb370525cbf144bedbf8f2e80
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.LimitClear.eprtx
                                        • Path C:\Users\Admin\Desktop\Fixed.LimitClear.eprtx
                                        • Size 749KB
                                        • SHA256 aa6166002474c85f55070d2a97c05b547993596c280be2cc4dc3f609ccbc8da9
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.LockConfirm.m1v
                                        • Path C:\Users\Admin\Desktop\Fixed.LockConfirm.m1v
                                        • Size 798KB
                                        • SHA256 4acea9c97fdcae845180b769896f25a154cebcfbe69cce227f91295a864a8db3
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.LockStart.DVR
                                        • Path C:\Users\Admin\Desktop\Fixed.LockStart.DVR
                                        • Size 700KB
                                        • SHA256 c7adb6d33fc5d38c5085b843e86e43d5b6469714f313814ed555e604c58477cf
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Fixed.desktop.ini
                                        • Path C:\Users\Admin\Desktop\Fixed.desktop.ini
                                        • Size 282B
                                        • SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Lock.AddClear.dll
                                        • Path C:\Users\Admin\Desktop\Lock.AddClear.dll
                                        • Size 675KB
                                        • SHA256 5658b447b7fa34b0c213d58dccda230df309102e247ecbd144a25fc3d0e0543f
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.AddDisable.mpeg3
                                        • Path C:\Users\Admin\Desktop\Lock.AddDisable.mpeg3
                                        • Size 602KB
                                        • SHA256 ed145c8fcf9a84047f5505bf0e756b934637a3d3b7c4bab8eaa3de0f82c13386
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ConvertHide.shtml
                                        • Path C:\Users\Admin\Desktop\Lock.ConvertHide.shtml
                                        • Size 307KB
                                        • SHA256 b3f887ceda81b77717fbef9359ae7f35c748d2f73622bfd6957fc9352a5d6fcb
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ConvertToInstall.cmd
                                        • Path C:\Users\Admin\Desktop\Lock.ConvertToInstall.cmd
                                        • Size 872KB
                                        • SHA256 e9130a83b3c94a0db9341c6cb8a90a8fb960f0a07ead3f9f73f27e5dbffb0378
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.DismountSplit.WTV
                                        • Path C:\Users\Admin\Desktop\Lock.DismountSplit.WTV
                                        • Size 380KB
                                        • SHA256 6721a1cc23ccc6e24e5e2a94da4482ae3151550fe3ea880554e24733bf1e5694
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.FormatConvertTo.html
                                        • Path C:\Users\Admin\Desktop\Lock.FormatConvertTo.html
                                        • Size 725KB
                                        • SHA256 cc691c4ddb7ced95dc882e46f0a53568a6c1e0e24745ec4f20353ac498eafcaa
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.FormatTest.htm
                                        • Path C:\Users\Admin\Desktop\Lock.FormatTest.htm
                                        • Size 577KB
                                        • SHA256 a96d8bb33a69db65ec91f962aa1278585d7cd39b87fa09acce639bbddee8a498
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.GetDismount.ppsm
                                        • Path C:\Users\Admin\Desktop\Lock.GetDismount.ppsm
                                        • Size 454KB
                                        • SHA256 07ab68dc73d0b771cf9fbcb05daaf3bde35baf3498cd18e5fe2fc0b3316f90c7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.InstallExpand.wdp
                                        • Path C:\Users\Admin\Desktop\Lock.InstallExpand.wdp
                                        • Size 1.2MB
                                        • SHA256 5863f4971ba107664a084ab965803c46a5bee9882d32f796e2d6e13a0e885f07
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.LimitClear.eprtx
                                        • Path C:\Users\Admin\Desktop\Lock.LimitClear.eprtx
                                        • Size 749KB
                                        • SHA256 3a604315a21d966703a749513cbfe94660f9a9ff7e809d37550462ff0af986ce
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.LockConfirm.m1v
                                        • Path C:\Users\Admin\Desktop\Lock.LockConfirm.m1v
                                        • Size 798KB
                                        • SHA256 7334effd9f09615a5a9bf7b563bddfa40223cc8092f974ac897ef6a580960844
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.LockStart.DVR
                                        • Path C:\Users\Admin\Desktop\Lock.LockStart.DVR
                                        • Size 700KB
                                        • SHA256 892bd0e53ad84bf4d8eb30183674d91098527eafd2b06b90d31d4f6a07fcd5c4
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.Microsoft Edge.lnk
                                        • Path C:\Users\Admin\Desktop\Lock.Microsoft Edge.lnk
                                        • Size 2KB
                                        • SHA256 4cdea9096a8c487843ba92e63b483e18e0897b563b2a2f550de039a8e99e8217
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Lock.NewUndo.wmv
                                        • Path C:\Users\Admin\Desktop\Lock.NewUndo.wmv
                                        • Size 405KB
                                        • SHA256 f89e28a9a60f6b80d321ccc5ab837a54e8bfea2f969b1e3b60086592d386fc97
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ProtectConvertTo.wvx
                                        • Path C:\Users\Admin\Desktop\Lock.ProtectConvertTo.wvx
                                        • Size 331KB
                                        • SHA256 cf7c44e0a92464613e07810cb9e82ac50a887f155e8e5b4abf8118e4067d47f9
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.PushResize.eprtx
                                        • Path C:\Users\Admin\Desktop\Lock.PushResize.eprtx
                                        • Size 823KB
                                        • SHA256 9c8c6af1bd50dd746062d739455708f243952c076d7e22a4832ac5a95bef0091
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ReadEnter.xlsb
                                        • Path C:\Users\Admin\Desktop\Lock.ReadEnter.xlsb
                                        • Size 503KB
                                        • SHA256 d6e186cab8d3b695257de965ae4417cd4deb702652d135e52389034cef40c4db
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.RemoveConnect.iso
                                        • Path C:\Users\Admin\Desktop\Lock.RemoveConnect.iso
                                        • Size 847KB
                                        • SHA256 d34550c237d1f0a2023b8ddc178969340c926fba5812afd8e31d25c1d3ec7065
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.RepairClear.M2TS
                                        • Path C:\Users\Admin\Desktop\Lock.RepairClear.M2TS
                                        • Size 651KB
                                        • SHA256 20b4607003e285765b5b3fd525daa2818c56fe30acdd9bd1559a1a63ae085570
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.RequestStart.mp3
                                        • Path C:\Users\Admin\Desktop\Lock.RequestStart.mp3
                                        • Size 479KB
                                        • SHA256 34e6aadca1b24b3c7ac418eb451aa9677452ed8fed80df2bacc6ef8c28f135f5
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ResetUnpublish.mov
                                        • Path C:\Users\Admin\Desktop\Lock.ResetUnpublish.mov
                                        • Size 528KB
                                        • SHA256 cbd90ab2d92acf4dcab7d69ef729a109ecad0e259cbb30879077f49ec0c661c5
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.RestartEnter.sys
                                        • Path C:\Users\Admin\Desktop\Lock.RestartEnter.sys
                                        • Size 430KB
                                        • SHA256 e4132ca0d28e2e055de9bb0810643656e4dd00e95c3e954c59352dc079823496
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.SplitDebug.pdf
                                        • Path C:\Users\Admin\Desktop\Lock.SplitDebug.pdf
                                        • Size 626KB
                                        • SHA256 97320187d059e4ba4ed3571c7ae60ee109783a536e545841cc645880fcdf4dde
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.SubmitCompress.001
                                        • Path C:\Users\Admin\Desktop\Lock.SubmitCompress.001
                                        • Size 774KB
                                        • SHA256 0eaf429c03dfa8e3a07be6a4bbb7731a15d6820107a66dfda53e7e3654152672
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.WaitInvoke.vsw
                                        • Path C:\Users\Admin\Desktop\Lock.WaitInvoke.vsw
                                        • Size 356KB
                                        • SHA256 c37a0542c8caeac909716bc8ffabda41f0d512de7b0b052858f6a382a74d26b7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.WriteImport.midi
                                        • Path C:\Users\Admin\Desktop\Lock.WriteImport.midi
                                        • Size 552KB
                                        • SHA256 9151958697f9d6de813064d2179ca39da7d8e2d8943b15c5c3a65dfd6a3221af
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.desktop.ini
                                        • Path C:\Users\Admin\Desktop\Lock.desktop.ini
                                        • Size 288B
                                        • SHA256 30fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Lock.AddImport.bat
                                        • Path C:\Users\Admin\Music\Lock.AddImport.bat
                                        • Size 461KB
                                        • SHA256 af9c893b6a899ec70c9357ed7273e04676209ebb5efab941170563e060b9251c
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ApproveCopy.xlsm
                                        • Path C:\Users\Admin\Music\Lock.ApproveCopy.xlsm
                                        • Size 218KB
                                        • SHA256 03ab56dbaea993d3b7b34cf920b0ca08ea35d64e3a38c8f17ebdfe91336b3f34
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.BlockBackup.m4a
                                        • Path C:\Users\Admin\Music\Lock.BlockBackup.m4a
                                        • Size 393KB
                                        • SHA256 4912fa3b091e756ea7862661348a097868dc8bd20ede54093dbc7a05c6363a23
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.CheckpointLimit.cab
                                        • Path C:\Users\Admin\Music\Lock.CheckpointLimit.cab
                                        • Size 189KB
                                        • SHA256 3b74296bc26de1af9aca7bb2babd726a0508b9d966ae922d485865785514e4ee
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.ClearPing.dot
                                        • Path C:\Users\Admin\Music\Lock.ClearPing.dot
                                        • Size 296KB
                                        • SHA256 844d099b70852da7d2745992944a96758f3f05af45bdad720ce8bf3e8f008b04
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Lock.desktop.ini
                                        • Path C:\Users\Admin\Music\Lock.desktop.ini
                                        • Size 512B
                                        • SHA256 34ae08d15c34e017facda7c39f7b5f9e8cc891b160072b908969a1a2523772aa
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Fixed.RemoveUntif
                                        • Path C:\Users\Admin\Pictures\Fixed.RemoveUntif
                                        • Size 4B
                                        • SHA256 ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        memory/760-638-0x00000000006A0000-0x0000000001A64000-memory.dmp
                                        Download

                                        memory/760-644-0x000000001C780000-0x000000001C790000-memory.dmp
                                        Download

                                        memory/760-777-0x000000001C780000-0x000000001C790000-memory.dmp
                                        Download

                                        memory/760-767-0x00007FFFF0C30000-0x00007FFFF16F2000-memory.dmp
                                        Download

                                        memory/760-637-0x00007FFFF0C30000-0x00007FFFF16F2000-memory.dmp
                                        Download

                                        memory/1096-112-0x000001C3F3E80000-0x000001C3F3EA0000-memory.dmp
                                        Download

                                        memory/1412-15-0x00007FFFEB4E0000-0x00007FFFEBE81000-memory.dmp
                                        Download

                                        memory/1412-3-0x00007FFFEB4E0000-0x00007FFFEBE81000-memory.dmp
                                        Download

                                        memory/1412-1-0x00007FFFEB4E0000-0x00007FFFEBE81000-memory.dmp
                                        Download

                                        memory/1412-19-0x0000000001A40000-0x0000000001A50000-memory.dmp
                                        Download

                                        memory/1412-0-0x000000001C5E0000-0x000000001CAAE000-memory.dmp
                                        Download

                                        memory/1412-18-0x00007FFFEB4E0000-0x00007FFFEBE81000-memory.dmp
                                        Download

                                        memory/1412-17-0x0000000001A40000-0x0000000001A50000-memory.dmp
                                        Download

                                        memory/1412-114-0x0000000001620000-0x000000000162A000-memory.dmp
                                        Download

                                        memory/1412-2-0x0000000001A40000-0x0000000001A50000-memory.dmp
                                        Download

                                        memory/1412-14-0x000000001E100000-0x000000001E119000-memory.dmp
                                        Download

                                        memory/1412-4-0x000000001BFF0000-0x000000001C02A000-memory.dmp
                                        Download

                                        memory/1412-5-0x000000001D060000-0x000000001D106000-memory.dmp
                                        Download

                                        memory/1412-11-0x000000001DCE0000-0x000000001DD7C000-memory.dmp
                                        Download

                                        memory/1412-12-0x0000000001730000-0x0000000001738000-memory.dmp
                                        Download

                                        memory/1412-13-0x000000001DDF0000-0x000000001DE52000-memory.dmp
                                        Download

                                        memory/1412-16-0x0000000001A40000-0x0000000001A50000-memory.dmp
                                        Download

                                        memory/1856-144-0x0000000000400000-0x000000000075A000-memory.dmp
                                        Download

                                        memory/2712-935-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-942-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-940-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-941-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-939-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-938-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-937-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/2712-936-0x0000000005BF0000-0x0000000005C00000-memory.dmp
                                        Download

                                        memory/4436-123-0x0000000000400000-0x0000000000A31000-memory.dmp
                                        Download