Overview

overview

10

Static

static

10

JOKE.exe

windows7-x64

10

JOKE.exe

windows10-1703-x64

10

JOKE.exe

windows10-2004-x64

10

JOKE.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    575s
  • max time network
    594s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/02/2024, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    JOKE.exe
  • Size 65KB
  • Sample240224-e2lvlshh8y
  • SHA256 e00d04dcc4489101599f86df3956673c2ebcb8adbf05fb603266b91e9336b955
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njrathackedevasionpersistenceransomwaretrojan

Malware Config

Extracted

Family

  • njrat

Version

  • Platinum

Botnet

  • HacKed

C2

  • 127.0.0.1:15217

Mutex

  • Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JOKE.exe
    "C:\Users\Admin\AppData\Local\Temp\JOKE.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4868
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:992
    • C:\Users\Admin\AppData\Local\Temp\70b6265c39b142559a655f40f3d16ae8.exe
      "C:\Users\Admin\AppData\Local\Temp\70b6265c39b142559a655f40f3d16ae8.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\System32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8D0.tmp\8D1.tmp\8D2.bat C:\Users\Admin\AppData\Local\Temp\70b6265c39b142559a655f40f3d16ae8.exe"
        3⤵
        • Checks computer location settings
        PID:2976
    • C:\Users\Admin\AppData\Local\Temp\c5e2c4685b4d46d79e31f7fb6dcd8d04.exe
      "C:\Users\Admin\AppData\Local\Temp\c5e2c4685b4d46d79e31f7fb6dcd8d04.exe"
      2⤵
      • UAC bypass
      • Disables RegEdit via registry modification
      • Drops startup file
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4308
      • C:\Windows\System32\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
        3⤵
        • Kills process with taskkill
        PID:4864
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4388
      • C:\Windows\System32\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
        3⤵
        • Kills process with taskkill
        PID:1828
    • C:\Users\Admin\AppData\Local\Temp\fe4b40b9e9824563b8ed53b9cd8692f6.exe
      "C:\Users\Admin\AppData\Local\Temp\fe4b40b9e9824563b8ed53b9cd8692f6.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Local\Temp\Ention.exe
        "C:\Users\Admin\AppData\Local\Temp\Ention.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ.txt
          4⤵
          • Suspicious use of FindShellTrayWindow
          PID:312
      • C:\Users\Admin\AppData\Local\Temp\Locker.exe
        "C:\Users\Admin\AppData\Local\Temp\Locker.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Sets desktop wallpaper using registry
        • Modifies Control Panel
        PID:4164
    • C:\Users\Admin\AppData\Local\Temp\0abc48bc70dc4b02be542a29d5a4e04d.exe
      "C:\Users\Admin\AppData\Local\Temp\0abc48bc70dc4b02be542a29d5a4e04d.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loll.VBS"
        3⤵
        • Enumerates connected drives
        PID:372
    • C:\Users\Admin\AppData\Local\Temp\1f4f58aef0cd43998661e843de3067ea.exe
      "C:\Users\Admin\AppData\Local\Temp\1f4f58aef0cd43998661e843de3067ea.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\play.vbs"
        3⤵
        • Enumerates connected drives
        PID:4172
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2736
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:5060
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:516
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1832
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4160
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:2652
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4816
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2ec
    1⤵
      PID:3148
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4592

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          CurrentDatabase_400.wmdb
          • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
          • Size 512KB
          • SHA256 b0631f999f4255aaf8169eaa6d6116ce805465aa5419fdf2013a0c4a6d0ff96a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WMSDKNS.XML.bak
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
          • Size 9KB
          • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          edgecompatviewlist[1].xml
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2D6264AR\edgecompatviewlist[1].xml
          • Size 74KB
          • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\D9J1GOXY\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ~DF905BE94D7D9FEC9B.TMP
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF905BE94D7D9FEC9B.TMP
          • Size 24KB
          • SHA256 3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FCALUWRY\base[1].js
          • Size 1.7MB
          • SHA256 8118050a27f735b626239738ae0e5ef7d7b79eb0fb27760dc1214c1f1ac00275
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          rs=AGKMywFRe-uXq3Zl7DKngxjSYzI0kR4DvQ[1].css
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FCALUWRY\rs=AGKMywFRe-uXq3Zl7DKngxjSYzI0kR4DvQ[1].css
          • Size 1.5MB
          • SHA256 72d2f9ef26363b27fe8bf6e491da6c6cc975707829fde01787830d1baea32242
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          scheduler[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FCALUWRY\scheduler[1].js
          • Size 9KB
          • SHA256 58ae013b8e95b7667124263f632b49a10acf7da2889547f2d9e4b279708a29f0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          css2[1].css
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G6IH1XRY\css2[1].css
          • Size 2KB
          • SHA256 42706c41583de3f0028f16bad17197dde81807d148ba848ea3924aff4bb8b532
          • MD5 SHA1 SHA512
          Submit Download

          intersection-observer.min[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G6IH1XRY\intersection-observer.min[1].js
          • Size 5KB
          • SHA256 3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          web-animations-next-lite.min[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G6IH1XRY\web-animations-next-lite.min[1].js
          • Size 49KB
          • SHA256 c12e3ac9660ae5de2d775a8c52e22610fff7a651fa069cfa8f64675a7b0a6415
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          webcomponents-ce-sd[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\G6IH1XRY\webcomponents-ce-sd[1].js
          • Size 95KB
          • SHA256 2fed236a295c611b4be5b9bc8608978e148c893e0c51944486982583b210668a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          www-main-desktop-player-skeleton[1].css
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LFEYDNZV\www-main-desktop-player-skeleton[1].css
          • Size 2KB
          • SHA256 056232b6127143e2f8bf4218db355d978e1e96f5dedcce59a9f5d6ab92b437f1
          • MD5 SHA1 SHA512
          Submit Download

          www-main-desktop-watch-page-skeleton[1].css
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LFEYDNZV\www-main-desktop-watch-page-skeleton[1].css
          • Size 5KB
          • SHA256 3c8b38d9b8a3301c106230e05beeedbcd28b12681f22fd9b09af9e52dc08635d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          www-onepick[1].css
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LFEYDNZV\www-onepick[1].css
          • Size 1011B
          • SHA256 6305c2a6825af37f17057fd4dcb3a70790cc90d0d8f51128430883829385f7cc
          • MD5 SHA1 SHA512
          Submit Download

          www-player[1].css
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\LFEYDNZV\www-player[1].css
          • Size 367KB
          • SHA256 5c6664535088c169d1900c7b4f749d59530506ba2f16bc07c131027a30662897
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          desktop_polymer[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZQ71I6HC\desktop_polymer[1].js
          • Size 64KB
          • SHA256 c30616610b8ff4c50213b70ab8eafc19c8156a20a96868ed63ea7a2672980d31
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          network[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZQ71I6HC\network[1].js
          • Size 14KB
          • SHA256 99599ec6f3fb4d9ae90a3ac4fa8e73448cd94e47a0662c7b80bc1427004f4e67
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          spf[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZQ71I6HC\spf[1].js
          • Size 38KB
          • SHA256 f333d8729a3c54012666dff2de67a567e3ade40c708cac4a1b6f7083cb1c5c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          www-i18n-constants[1].js
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZQ71I6HC\www-i18n-constants[1].js
          • Size 5KB
          • SHA256 263c24ac72cb26ab60b4b2911da2b45fef9b1fe69bbb7df59191bb4c1e9969cd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
          • Size 1KB
          • SHA256 482537b14f03f06c5f7910d089094612fa9940813eb0f1a63330f18d2b632f96
          • MD5 SHA1 SHA512
          Submit Download

          CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
          • Size 724B
          • SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
          • MD5 SHA1 SHA512
          Submit Download

          E87CE99F124623F95572A696C80EFCAF_9F04E35CA28A5C68B5490FBED6478178
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9F04E35CA28A5C68B5490FBED6478178
          • Size 471B
          • SHA256 0b4176a4107aa865df5d96114692076511aafbfd7f5a38d70eeb36076fd25606
          • MD5 SHA1 SHA512
          Submit Download

          E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670
          • Size 472B
          • SHA256 bdf4ccfcdc71b2f78afe4fd7beb11e0b3ac8b87fd26393623bf25c78a4995672
          • MD5 SHA1 SHA512
          Submit Download

          24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
          • Size 410B
          • SHA256 ba8144b9c78147903b87eb08e3f2bed062fa7a1c1c8a35bea76ae24b87f0bef0
          • MD5 SHA1 SHA512
          Submit Download

          CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
          • Size 392B
          • SHA256 208101d43d87f2ebef1ab89c81843b24453643e2eae75d6f7217102de2b5fe29
          • MD5 SHA1 SHA512
          Submit Download

          E87CE99F124623F95572A696C80EFCAF_9F04E35CA28A5C68B5490FBED6478178
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9F04E35CA28A5C68B5490FBED6478178
          • Size 406B
          • SHA256 5ee6bd6e5801c6fdd6ec82df943562e9ff7216047ceffe10fdb7c567a3de629d
          • MD5 SHA1 SHA512
          Submit Download

          E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670
          • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_B744ED683086DD422B6453395135F670
          • Size 402B
          • SHA256 fc35fab32aa4d7e870515483a474eacbbf7d5fbd4bcb017ad417963be0bbfb7e
          • MD5 SHA1 SHA512
          Submit Download

          70b6265c39b142559a655f40f3d16ae8.exe
          • Path C:\Users\Admin\AppData\Local\Temp\70b6265c39b142559a655f40f3d16ae8.exe
          • Size 86KB
          • SHA256 55eb5e8387b9b1e9982287ea45bc20a86d6f5b0fe02f92f5ac2f569df1355d68
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          8D2.bat
          • Path C:\Users\Admin\AppData\Local\Temp\8D0.tmp\8D1.tmp\8D2.bat
          • Size 60B
          • SHA256 152053eb315110ca3a65f3393004e9b33f5eeccd953f5ca1e1734e659544728b
          • MD5 SHA1 SHA512
          Submit Download

          Ention.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
          • Size 620KB
          • SHA256 6dd4243a47c027a7a23bc43bc769f611b515bae40ccc2085c3f7c976161134fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Ention.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Ention.exe
          • Size 847KB
          • SHA256 e961caaa4f22b6f9a86c4e72b529861fb8a5a6b55d4bd2e64c005be4b007eeaa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Locker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Locker.exe
          • Size 633KB
          • SHA256 374eab1c5abd8dbab74f74d53c4066257642d485f7508d1f549b7a6a85fff3d2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Locker.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Locker.exe
          • Size 793KB
          • SHA256 7a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          autDD9.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\autDD9.tmp
          • Size 138KB
          • SHA256 b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          c5e2c4685b4d46d79e31f7fb6dcd8d04.exe
          • Path C:\Users\Admin\AppData\Local\Temp\c5e2c4685b4d46d79e31f7fb6dcd8d04.exe
          • Size 718KB
          • SHA256 260d7ec67c731a751625ef18ea5d73b2423478310cda8581a31628d5764d8f2c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          c5e2c4685b4d46d79e31f7fb6dcd8d04.exe
          • Path C:\Users\Admin\AppData\Local\Temp\c5e2c4685b4d46d79e31f7fb6dcd8d04.exe
          • Size 888KB
          • SHA256 e0c1e1aee89fd47a249107a8e387d402378c59458222510bea3356b29fa135e7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          fe4b40b9e9824563b8ed53b9cd8692f6.exe
          • Path C:\Users\Admin\AppData\Local\Temp\fe4b40b9e9824563b8ed53b9cd8692f6.exe
          • Size 2.4MB
          • SHA256 247c794eb6da41670130500fb9bf3415261b328d1854cde52cee12b1e465dfd3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          fe4b40b9e9824563b8ed53b9cd8692f6.exe
          • Path C:\Users\Admin\AppData\Local\Temp\fe4b40b9e9824563b8ed53b9cd8692f6.exe
          • Size 2.3MB
          • SHA256 e9dcefad91a8d500da841742779c751f21622c4da8916c7ce6790323d09eb793
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Новый текстовый документ.txt
          • Path C:\Users\Admin\AppData\Local\Temp\Новый текстовый документ.txt
          • Size 331B
          • SHA256 3f93a8b1cdb1a748236e3d4230bd856abefa8d3660b691de89c5fc4e249a0fed
          • MD5 SHA1 SHA512
          Submit Download

          CachedImage_1280_720_POS2.jpg
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS2.jpg
          • Size 45KB
          • SHA256 2f18ae84098647ccba038f6a3da82b03b1b43e1f035f4a6d583c63f10d0a40c7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          TranscodedWallpaper
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
          • Size 58KB
          • SHA256 cbd11c45f80a45a7219c0590b04185250e1a9b898d9b905837808855c785431b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.AddShow.temp
          • Path C:\Users\Admin\Desktop\Lock.AddShow.temp
          • Size 281KB
          • SHA256 539b57b96a11f22963edc81730d9ddef8b6591ebaf9462418e36f4e85e87f5a0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.CompareWatch.docx
          • Path C:\Users\Admin\Desktop\Lock.CompareWatch.docx
          • Size 128KB
          • SHA256 90a8e8573bdac723d41dece7e6f51a27d1a39a72cbe6ec8cf6ab5186c7919734
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.ConnectStart.contact
          • Path C:\Users\Admin\Desktop\Lock.ConnectStart.contact
          • Size 254KB
          • SHA256 f2c666b2eba1d10dcbb790e7b7fbf6433f65122be0a1744755e74eacc4a762b6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.DisconnectPublish.tif
          • Path C:\Users\Admin\Desktop\Lock.DisconnectPublish.tif
          • Size 327KB
          • SHA256 fee060d593815cb8e4541715ecfa56e36fef2440f64fbe48addc9edbdf256292
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.FindHide.eprtx
          • Path C:\Users\Admin\Desktop\Lock.FindHide.eprtx
          • Size 136KB
          • SHA256 3784c78f25f26f9fec7a50a5c59eea24af4abf2902a3bb635aecdf835e0769b6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.GroupExit.ogg
          • Path C:\Users\Admin\Desktop\Lock.GroupExit.ogg
          • Size 118KB
          • SHA256 366ca92becb70660c1c016b616514a4f0f383d0d7cefea5a6823a34f1bd4b9db
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.GroupRead.mpeg
          • Path C:\Users\Admin\Desktop\Lock.GroupRead.mpeg
          • Size 209KB
          • SHA256 7e834da22de1cca1a362b9ebea552c8927d5aa0bc8b2b6b1dd07c878e145febf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.InitializeUndo.fon
          • Path C:\Users\Admin\Desktop\Lock.InitializeUndo.fon
          • Size 172KB
          • SHA256 53091f434fd8d4e8d31377927f3e4b261da5a02377380dc0d944f3c12f57a38d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.InstallEnable.search-ms
          • Path C:\Users\Admin\Desktop\Lock.InstallEnable.search-ms
          • Size 263KB
          • SHA256 bd18f7e68e27d9f5a083cde58c8f33eb2fb286b88eb9e9d98d63f00c9fc2c604
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.MeasurePublish.mpeg
          • Path C:\Users\Admin\Desktop\Lock.MeasurePublish.mpeg
          • Size 309KB
          • SHA256 b97562b6b6432edc1f257513e1d029a4013610f89f9a0d4a037fa42d80aa00e5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.ReadSwitch.xht
          • Path C:\Users\Admin\Desktop\Lock.ReadSwitch.xht
          • Size 190KB
          • SHA256 1661eac8c7dd045c541614ca4f4d1b2db62302634e1489a8c91249755d14dba5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.RenameUnprotect.hta
          • Path C:\Users\Admin\Desktop\Lock.RenameUnprotect.hta
          • Size 227KB
          • SHA256 e03dc6785b36e8de78641684d75f3e186f895941bc3b864ee21ef6ab56caaffe
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.RequestStart.potx
          • Path C:\Users\Admin\Desktop\Lock.RequestStart.potx
          • Size 336KB
          • SHA256 01b9254f0c0a829d05998591ba163606f269fba3c045a7d7b82d00e39f3395c4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.ResizeEnable.dwfx
          • Path C:\Users\Admin\Desktop\Lock.ResizeEnable.dwfx
          • Size 218KB
          • SHA256 28f1671b83f0b53e3f55e2bfb0d263cd52a8c7200c566bd4f393ac070552959d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.ResolveRevoke.M2T
          • Path C:\Users\Admin\Desktop\Lock.ResolveRevoke.M2T
          • Size 154KB
          • SHA256 2fa53e32b9dcd857ecd7bc4a56dadf1daaec0f8695d8cbb44c2fae0be36e1e55
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.RestartTrace.jpe
          • Path C:\Users\Admin\Desktop\Lock.RestartTrace.jpe
          • Size 236KB
          • SHA256 d6ac55cf8286bb9ca6b1c3e2bdc9f2fb80e3fcc9ed8deebfc6d6ad5184380ef8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.SelectPing.wmv
          • Path C:\Users\Admin\Desktop\Lock.SelectPing.wmv
          • Size 64KB
          • SHA256 154171db589c7720f8db73d9179c1f307699ac124087b5570195ebd0bb16879a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.SendMerge.TTS
          • Path C:\Users\Admin\Desktop\Lock.SendMerge.TTS
          • Size 199KB
          • SHA256 7d08b8772e346e0c24935b4d45495c0783d636556deec25e48b5a1606d52bec8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.ShowUndo.snd
          • Path C:\Users\Admin\Desktop\Lock.ShowUndo.snd
          • Size 181KB
          • SHA256 292fb5d8e6a929a75a3f9f3567443fee3e16cea13682933f2e77a2a28871db4b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.StartFormat.reg
          • Path C:\Users\Admin\Desktop\Lock.StartFormat.reg
          • Size 245KB
          • SHA256 eb9951b35952c025150e1f6d93c17b43e85dd7ed4c255586ff638c843427ca39
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.UndoExit.jtx
          • Path C:\Users\Admin\Desktop\Lock.UndoExit.jtx
          • Size 290KB
          • SHA256 2a61d6968632f1e77f8a0ae805120d04caf5e02670cdcfd097163aa254c4076a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.UnlockReceive.asx
          • Path C:\Users\Admin\Desktop\Lock.UnlockReceive.asx
          • Size 163KB
          • SHA256 71e6da70a8514a31837f1ebf14c54b1ca52219a67e6f5dc42a2bdf35f92190c8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.UnlockSkip.hta
          • Path C:\Users\Admin\Desktop\Lock.UnlockSkip.hta
          • Size 272KB
          • SHA256 61532c2c36f93a44a2e5cf8c4649839a1fbb1659c443a9df4fffb29f3fbc707e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.UpdateInstall.odt
          • Path C:\Users\Admin\Desktop\Lock.UpdateInstall.odt
          • Size 145KB
          • SHA256 f83119e6dc36294fae8c33829dd7e1c2168ab9f77246cd69cb3a4b661365d0ba
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.WaitClose.cr2
          • Path C:\Users\Admin\Desktop\Lock.WaitClose.cr2
          • Size 299KB
          • SHA256 1ba900246964cc9e9325dc33f28a403b0cdf38354e69d781c13a8b26c2273164
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Lock.desktop.ini
          • Path C:\Users\Admin\Desktop\Lock.desktop.ini
          • Size 288B
          • SHA256 30fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a
          • MD5 SHA1 SHA512
          Submit Download

          Lock.Are.docx
          • Path C:\Users\Admin\Documents\Lock.Are.docx
          • Size 11KB
          • SHA256 ce28015b2b93deed2c7569c325e811aa9a0eef29070ae6f73e59dbdee7009fc8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          amogus_icon.ico
          • Path C:\amogus_icon.ico
          • Size 42KB
          • SHA256 77aa5f8536b9c30133f8083712b2d5434123d31a6ed41f0680fce52e06144187
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          avocado_icon.ico
          • Path C:\avocado_icon.ico
          • Size 80KB
          • SHA256 c87dc1a91720070afe96d3be716d6203540da4d08e9d2339967a8a2a6a521d42
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          backg.jpg
          • Path C:\backg.jpg
          • Size 74KB
          • SHA256 ddc65eb885e5f89406a0b9ec5d23b0bf041ef9c15b689ddf6b855c9a62132200
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ben_icon.ico
          • Path C:\ben_icon.ico
          • Size 109KB
          • SHA256 66775b29fdbd36e7ea15b038224a12271fe84b0e1129b11dec008af1dec986b3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          dad_icon.ico
          • Path C:\dad_icon.ico
          • Size 91KB
          • SHA256 f500586d27d938ebfc965c59cdc42e361b78bc41246d52a075bc278271c96fc6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          guy_icon.ico
          • Path C:\guy_icon.ico
          • Size 81KB
          • SHA256 2b670bfb2029e8f023f13180780c648f606bb91fd5854e45e08c27bad2f4e1b8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          obama_icon.ico
          • Path C:\obama_icon.ico
          • Size 91KB
          • SHA256 99232a1b8d11825ccdc89ad8a9e095c6a1c36731836c17207ec5f45cfc0270f7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          rock_eyebrow_icon.ico
          • Path C:\rock_eyebrow_icon.ico
          • Size 56KB
          • SHA256 da6e60fa7d074a5b8a90e3ebe53ed1c01661423ec0ec1ff154857bcef14ecff7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          skream_icon.ico
          • Path C:\skream_icon.ico
          • Size 52KB
          • SHA256 e1e71925f5169df514d0c196f41fe91ae1419426ed28422aea78ab85b4dafbc4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          speedrunner_icon.ico
          • Path C:\speedrunner_icon.ico
          • Size 66KB
          • SHA256 c34b87c2f0454d80f7b1989e80eb5b6ca04052c16f94ce294f15a0053cc76ce2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          startup.exe
          • Path C:\startup.exe
          • Size 16KB
          • SHA256 6be68911f16ec9283da61ce222d946c9e8e5ea39d71ad9d23216b4961947d180
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          the_wok_icon.ico
          • Path C:\the_wok_icon.ico
          • Size 68KB
          • SHA256 ac084f24272a89b616e21add98739a7c4dc55830e6c7ac8fff74a9d495eef4c5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          theme.wav
          • Path C:\theme.wav
          • Size 2.7MB
          • SHA256 5b41d14436cdd8e5467be6a1705daa108c428176c9fa4f9c74bd88cd4b703960
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ustupid_icon.ico
          • Path C:\ustupid_icon.ico
          • Size 59KB
          • SHA256 b856abc28d3d026fbe327376bbd72f7a169012bc987d59dc9fe600e9714ff634
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          walt_icon.ico
          • Path C:\walt_icon.ico
          • Size 113KB
          • SHA256 335b92e10ea035e1061ab8d44d02472d2db80a838eae63900b9d02ab9483c4af
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          whenimpostaissus_icon.ico
          • Path C:\whenimpostaissus_icon.ico
          • Size 89KB
          • SHA256 8a5f22591d81c5ce727cab12fa380c3331fd9a3118a69667bd21b8ed9d6bb96f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          xina_icon.ico
          • Path C:\xina_icon.ico
          • Size 75KB
          • SHA256 8d49d92735d094885cbb57a63988e6205b5a477f2a571aff2f1e8d295f3d8e2f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Client.exe
          • Path \??\f:\Client.exe
          • Size 65KB
          • SHA256 e00d04dcc4489101599f86df3956673c2ebcb8adbf05fb603266b91e9336b955
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/372-902-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/372-903-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/372-906-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/372-899-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/372-900-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/372-898-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/372-896-0x0000000008530000-0x0000000008540000-memory.dmp
          Download

          memory/1168-2-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
          Download

          memory/1168-8-0x0000000074180000-0x0000000074730000-memory.dmp
          Download

          memory/1168-1-0x0000000074180000-0x0000000074730000-memory.dmp
          Download

          memory/1168-0-0x0000000074180000-0x0000000074730000-memory.dmp
          Download

          memory/1168-9-0x0000000074180000-0x0000000074730000-memory.dmp
          Download

          memory/1168-10-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
          Download

          memory/1168-11-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
          Download

          memory/1168-12-0x0000000002EA0000-0x0000000002EB0000-memory.dmp
          Download

          memory/1756-313-0x0000000000400000-0x0000000000A31000-memory.dmp
          Download

          memory/1792-325-0x0000000000400000-0x000000000075A000-memory.dmp
          Download

          memory/2652-202-0x000002285D020000-0x000002285D040000-memory.dmp
          Download

          memory/2736-294-0x000002014FCB0000-0x000002014FCB1000-memory.dmp
          Download

          memory/2736-55-0x000002014FCC0000-0x000002014FCC2000-memory.dmp
          Download

          memory/2736-290-0x000002014FCF0000-0x000002014FCF1000-memory.dmp
          Download

          memory/2736-287-0x0000020154000000-0x0000020154002000-memory.dmp
          Download

          memory/2736-245-0x0000020157A90000-0x0000020157A91000-memory.dmp
          Download

          memory/2736-246-0x0000020157AA0000-0x0000020157AA1000-memory.dmp
          Download

          memory/2736-36-0x000002014FA00000-0x000002014FA10000-memory.dmp
          Download

          memory/4160-126-0x000001A3F72E0000-0x000001A3F7300000-memory.dmp
          Download

          memory/4160-102-0x000001A3F7370000-0x000001A3F7372000-memory.dmp
          Download

          memory/4160-111-0x000001A3F7390000-0x000001A3F7392000-memory.dmp
          Download

          memory/4160-115-0x000001A3F73C0000-0x000001A3F73C2000-memory.dmp
          Download

          memory/4172-931-0x0000000005D00000-0x0000000005D10000-memory.dmp
          Download

          memory/4172-939-0x0000000005D00000-0x0000000005D10000-memory.dmp
          Download

          memory/4172-941-0x0000000005D00000-0x0000000005D10000-memory.dmp
          Download

          memory/4172-936-0x0000000005D00000-0x0000000005D10000-memory.dmp
          Download

          memory/4172-934-0x0000000005D00000-0x0000000005D10000-memory.dmp
          Download

          memory/4308-874-0x00007FFF99AB0000-0x00007FFF9A49C000-memory.dmp
          Download

          memory/4308-306-0x00000000006A0000-0x0000000001A64000-memory.dmp
          Download

          memory/4308-305-0x00007FFF99AB0000-0x00007FFF9A49C000-memory.dmp
          Download

          memory/4308-307-0x00000000022F0000-0x0000000002300000-memory.dmp
          Download

          memory/4308-454-0x00007FFF99AB0000-0x00007FFF9A49C000-memory.dmp
          Download

          memory/4308-455-0x00000000022F0000-0x0000000002300000-memory.dmp
          Download

          memory/4308-595-0x00000000022F0000-0x0000000002300000-memory.dmp
          Download

          memory/4308-755-0x00000000022F0000-0x0000000002300000-memory.dmp
          Download

          memory/4388-616-0x0000000002F70000-0x0000000002F71000-memory.dmp
          Download

          memory/4592-628-0x0000027DD4340000-0x0000027DD4360000-memory.dmp
          Download

          memory/4592-632-0x0000027DD4670000-0x0000027DD4690000-memory.dmp
          Download

          memory/4816-221-0x000001F1F7080000-0x000001F1F7082000-memory.dmp
          Download

          memory/4816-225-0x000001F1F70C0000-0x000001F1F70C2000-memory.dmp
          Download

          memory/4816-219-0x000001F1F64C0000-0x000001F1F64C2000-memory.dmp
          Download