Analysis

  • max time kernel
    1467s
  • max time network
    1457s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-02-2024 04:26

General

  • Target

    JOKE.exe

  • Size

    65KB

  • MD5

    a85056ecfbf94af8efaa2e9dcec8ebb1

  • SHA1

    f081275fbbdddad10689e185a750e1fd1ca0d0e5

  • SHA256

    e00d04dcc4489101599f86df3956673c2ebcb8adbf05fb603266b91e9336b955

  • SHA512

    c510e21e4d5b2b8fb2e7e902f74a6befbe20896490e607d640a2611020f20cede1d154e894fde5be8a6a2e564d2d7eb6d741d9b3ef21cdbefc5abdbc6a056fa9

  • SSDEEP

    1536:yw10jQoN36tKQviFw1ufGqBnvALfLteF3nLrB9z3nWaF9bJS9vM:yw10jQoN36tKQviFCe1BnAfWl9zGaF9Z

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:15217

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Control Panel 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JOKE.exe
    "C:\Users\Admin\AppData\Local\Temp\JOKE.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:716
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4372
    • C:\Users\Admin\AppData\Local\Temp\af7ce5780eb74c64bab60dea864e29b0.exe
      "C:\Users\Admin\AppData\Local\Temp\af7ce5780eb74c64bab60dea864e29b0.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      PID:1020
    • C:\Users\Admin\AppData\Local\Temp\9a20820f7ae74f2a85de829e243f8c85.exe
      "C:\Users\Admin\AppData\Local\Temp\9a20820f7ae74f2a85de829e243f8c85.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      PID:4188
    • C:\Users\Admin\AppData\Local\Temp\14fdb863fe4444678c7b957e43504474.exe
      "C:\Users\Admin\AppData\Local\Temp\14fdb863fe4444678c7b957e43504474.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\83AB.tmp\83AC.tmp\83AD.bat C:\Users\Admin\AppData\Local\Temp\14fdb863fe4444678c7b957e43504474.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/lFwy2c-5Rwg
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffafd2646f8,0x7ffafd264708,0x7ffafd264718
            5⤵
              PID:4236
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
              5⤵
                PID:3488
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                5⤵
                  PID:2648
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
                  5⤵
                    PID:3208
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                    5⤵
                      PID:4528
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                      5⤵
                        PID:2304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
                        5⤵
                          PID:4244
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                          5⤵
                            PID:3628
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4148 /prefetch:8
                            5⤵
                              PID:1428
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
                              5⤵
                                PID:1020
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
                                5⤵
                                  PID:976
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                  5⤵
                                    PID:4412
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                                    5⤵
                                      PID:4528
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
                                      5⤵
                                        PID:4216
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                                        5⤵
                                          PID:1604
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12698391149725913272,7388856204132661249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
                                          5⤵
                                            PID:1720
                                  • C:\Windows\system32\AUDIODG.EXE
                                    C:\Windows\system32\AUDIODG.EXE 0x3b8 0x3c8
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3132
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:5092
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:3528
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:680

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          d4c957a0a66b47d997435ead0940becf

                                          SHA1

                                          1aed2765dd971764b96455003851f8965e3ae07d

                                          SHA256

                                          53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

                                          SHA512

                                          19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          343e73b39eb89ceab25618efc0cd8c8c

                                          SHA1

                                          6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

                                          SHA256

                                          6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

                                          SHA512

                                          54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          360B

                                          MD5

                                          1cd3f2032aeae03060fb7720310509da

                                          SHA1

                                          e3eab5a1e13ef44074d890d28a59b41af74e0a6e

                                          SHA256

                                          8836b960bb0555c17b5c59de4c7863e4921611b7c51513b98041c2451cada871

                                          SHA512

                                          489a6ffab3cc5749a8ab48a755e2203feb834f9140e4610f244b48885d0c3688a0ceb440c9918ad42baa72133ee15d3b3d4d8bb57ae6c01088f61d10c59c7678

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          a9f484bcf45d89ae043805a179bc8177

                                          SHA1

                                          bf5c977c8ef16f5014e4df7e602956d8f83d80c5

                                          SHA256

                                          77acc6439f430946885e77917f96d85596e205e0e761e918c479dd12714f19cb

                                          SHA512

                                          b59b11ec782b3a0a7fb6af737f3d6dbe50c5845d9c238a466bccf673ba7ea50c26dd0279261e4e99173ab66f388ff6dc367a8cc55796b5573a4cc995aca06b78

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          871d7cc1d1f6eb4e8f9a3860f8d5d2e2

                                          SHA1

                                          d787eeded82a0d6d1ce805e968ca78e06d42b8b1

                                          SHA256

                                          a062c4fdae4bf2c6da41c40e0f9219073434d08ca0dcb3e10b17bc4f876e3eee

                                          SHA512

                                          07ce0ec1d9d39b71cc2320c535e813e5726774f34530d243d69f5500bf6a199af4073d7902c5d270baf58ba4d5777779cd153fbcad558f8ca5be0fb3ee340ff6

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          87c054e5d4068438aeac6aba4e20ede1

                                          SHA1

                                          7c8dd1433f81b525091a2f1d35eb8d3f99e423d0

                                          SHA256

                                          25f0b0d3e54c289f2f5e39ae1a77aa22c9a9058674e15bfb31f091f7b72f497d

                                          SHA512

                                          6e52f217b395404e32394d3b082e215c039ec5516283669282cc7881d3404264b26bd4c2429c4383383dfb0f553dc85f5fe01de78b1276cb853b3bae3dbc54cd

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          90a027910889f38c7b2215bd4dc1d74a

                                          SHA1

                                          62553885eea7d320d875f16b7a459f04ce8a7af1

                                          SHA256

                                          57ed6ddde35d6c6b3f63f781f0def4862df4d21c6727c9f01ad7bc3b50233e36

                                          SHA512

                                          12a6f41e9e2fd2b944e94909f7f4f3abd79809039ba13d3b19a65788b92a4bd490e1aef8a1c3d8331852252e5b29e2dfbdb5c72a601aa73b37449d56121d5dae

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          2dd43321fb553783be010f3d92eef1c5

                                          SHA1

                                          e49b37e0f897d47d7d1974b836ffb56216005267

                                          SHA256

                                          78bf100c1c7e4c165b0c4b8a45e79955a466ce9a42920de745ddb000ba0e0cfc

                                          SHA512

                                          7da729d0b8b8b795ff9aa0b21b4988a8f7a1b600f52e0ebe11ad77a52e6c6f1fafd66cf730ef70de0fd1b692ddb6798cdaf0d0c6593cf57c9cb88a9f2e7ddfb5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          e0d65f3ed65d94a4e42453fd53591983

                                          SHA1

                                          c982e5e2ed4a9962dd962069e83ba06344a03289

                                          SHA256

                                          92a43f1875f99920a6a1a7b42e27dff46713feebdeec737ae4bbec1497bd8547

                                          SHA512

                                          f68106700fb6dd1bd7156ee90bd68cca841281d21e6434c10862a921d03249474866609305c34b455b7cc4de4058cf007b5394901b667eb83db65bcabd434941

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\235b360a-ec4b-4ddf-a580-4b51ecb43d33\index-dir\the-real-index

                                          Filesize

                                          2KB

                                          MD5

                                          a19d5571b4682353eafe2879023258b1

                                          SHA1

                                          bcd0930d6332286d117e9545b5d40a5fbac6cad1

                                          SHA256

                                          af95a2d4cb695ca80548f7bc6a0fd1410a2f60f38461fa621b4b2ad7678c5e98

                                          SHA512

                                          b8179fb18d3c586e78e0c66434dd8e89f85c4e47620a979b428d36746c684ea9b8486240953651dca8d0d507b7d388c53f130fe34d380f5a1293bbfcab2d6e55

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\235b360a-ec4b-4ddf-a580-4b51ecb43d33\index-dir\the-real-index~RFe60e5c0.TMP

                                          Filesize

                                          48B

                                          MD5

                                          b84a6dab6c5809ebeec4ca2b63576c42

                                          SHA1

                                          6761b5ff982d02bee43da80c17ae083c0f92922d

                                          SHA256

                                          bfcf6cd4e757b46ed6655e60065b70aba12d3c7440dcf78d1477f6bf74bd1d70

                                          SHA512

                                          b04d48bedd4b6b270bf6fd4b95cb493833f30653a099ef81c3adf766a6e127dccb481647e73e8e517f8b244442c49e9ecc9d40530f4174765fa21a340abee9b4

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                          Filesize

                                          146B

                                          MD5

                                          20b13bde8196595c4daa8c273922a9c8

                                          SHA1

                                          f00806eef769a0b5172797758e1fcd9779efa09c

                                          SHA256

                                          746ac70fb00bc228862ac8337983b570c77a11060ed4ca632331ecdc3e0aa9b6

                                          SHA512

                                          87394535fb4aa9b15e9b283b92a5ce695fd72c9169dc0fe2dbd970d880fac11e7b9e2f437ae598a7ff11a86f8b15332cb5b5c9a77000748e9619e5c58a6fd524

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                          Filesize

                                          84B

                                          MD5

                                          8b69bea97f2f56cad86b243fa9a84b38

                                          SHA1

                                          adfb6bc33b41439b2d88d0cdb47d45f27d680f24

                                          SHA256

                                          ecebfbfbb96b9fcb810bd89ad47464078a9eaf09c49bdc03ae4270f0183eb09d

                                          SHA512

                                          479789a7d2b2076653932445dff1e4289fa55ceb7207bc1a9151898c92f7d65b401338433c01040b03b7deed18f904a9c3365ec43f11600a9e88ce2e07deabf4

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                          Filesize

                                          82B

                                          MD5

                                          5ac5e879daf311da068f1f12f7e8ac02

                                          SHA1

                                          54e9c695a72eb75d47e39409e6b12b25091d46b6

                                          SHA256

                                          5e5e15bcb4e81e20d0b1c9f28471bf6ff087e078fea1df0f253341515d72c7fb

                                          SHA512

                                          2d22168a5d388c8457ed346e611c6569fd34dbd6ec8343704fcda8882d0507a6da2074e058c4179ca9de2af6f5a1fbdcbe76786084ede32af065b5b31fcd1fee

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe6090ab.TMP

                                          Filesize

                                          89B

                                          MD5

                                          3d9ce96fa073c21716fc39818e029d60

                                          SHA1

                                          9a2faa681910d5caea681b73ab33e8e8c6b5b828

                                          SHA256

                                          13369da4514ae936859c22081732afd4c0a404e45c58212f81e5cfc3009290d3

                                          SHA512

                                          da47a39d074ba83ca2dd689d18a8d2ab2b5e4689a0dbb85508afcd169f1716f0139ced7aec6943cfa0f981507541b05c5ab9a8e9ca6b0dbf5bb5fe4d148e26e6

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                          Filesize

                                          72B

                                          MD5

                                          41ef8dcb7b8a4d1d49e1a4a190d5bae0

                                          SHA1

                                          f67caeb8ba970cde0543fac7dde0753466289da1

                                          SHA256

                                          742820aee2f229a872d99e787273a4e922ad770b9693a152cbd9ec293ea36207

                                          SHA512

                                          fbe3cf0c994d12cdb159a385bd8560b30c5c43ca06fbcdfdc8f2b204620dcbd7c6dfdf27d68393d7109df434b57d1f3f34bf5312aea77464d077c0ef0f71109c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe60df96.TMP

                                          Filesize

                                          48B

                                          MD5

                                          7d911b7826da476a75982742da6ae581

                                          SHA1

                                          e4b65dff5c13baa82e6e388369bd503dcec1f9fe

                                          SHA256

                                          a9c341bd3bd276924d54712ff8e5e6275fb5ab80e850f402499cfb0233546b86

                                          SHA512

                                          38d176e7df73f9f10dc68b92191df1092dd2c6098a3b6ce83afe651af792f79ba726e56986bacffdf1be497bae96db53fafa449fcd0b3e254a190b75920711f1

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          36dc2f1972327245f7fc4ff16ea03ef2

                                          SHA1

                                          97fc1741b65d725c8a43f9d57bf57fa8d55d297e

                                          SHA256

                                          41a02b538d31d4d03897c54d17f0623e6d00493eeca92bbf3b68089bf63b04a3

                                          SHA512

                                          6b41cb3cb6744b93b164f952595d442665f1b4ff303fcc884717f8a02385689bd7e09ffa742d51b006b568b49a2123972b0b07360e045dd82cb330ab6fad091b

                                        • C:\Users\Admin\AppData\Local\Temp\14fdb863fe4444678c7b957e43504474.exe

                                          Filesize

                                          86KB

                                          MD5

                                          dd15af9b32ea193e0c82887e4601f2a7

                                          SHA1

                                          bab37b838bc1d858906f1ddc66c5d1168320d192

                                          SHA256

                                          7189f55b3d5153bd190991dc5e3349755e300fd20b0e52a34e57579e20308888

                                          SHA512

                                          f51542a4f6ae0d92cfe18afe4ff64c4961e04e24f2fa88da1adcaeebae28928c63e3d33e975fd413608fd3d03c5111340dbd8c4ff6a721e72154f5b7c5a54688

                                        • C:\Users\Admin\AppData\Local\Temp\9a20820f7ae74f2a85de829e243f8c85.exe

                                          Filesize

                                          653KB

                                          MD5

                                          c29e84272de123ac2cae92bf8210d95b

                                          SHA1

                                          1b60b8f5430707ca08d806e5739553cd6cfccf89

                                          SHA256

                                          42c145d05f5a3d20a4df748d488e32f986ef0bbd370dd086b6f431e00a5efb14

                                          SHA512

                                          055aebf709f23647783f034913fd61721649ceddcc1357b4bd34ecd446b059f27c57a16392943000d7f2152cdec51043d11910fae1dd002f043f300d9724ee6e

                                        • C:\Users\Admin\AppData\Local\Temp\af7ce5780eb74c64bab60dea864e29b0.exe

                                          Filesize

                                          793KB

                                          MD5

                                          a83185ef7c03bfe0e0fbe10098876a34

                                          SHA1

                                          b166fed95e9bcc9f8b0ac4deafa9c45c21e91d0d

                                          SHA256

                                          7a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be

                                          SHA512

                                          283e698b326d044480c49351531249ab9ed3a851c1d2c4a36c87fc5ecbaf2771af58f39cc0fc1551d08a4674ad766a3d4b96b6ee6ca1e6e967727f320f599f4c

                                        • C:\Users\Admin\AppData\Local\Temp\autC7FC.tmp

                                          Filesize

                                          138KB

                                          MD5

                                          7c30424c525cb64760083e066ca1f77d

                                          SHA1

                                          69c369028e3db4fe5c2fbc69cbd837d66496c480

                                          SHA256

                                          b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643

                                          SHA512

                                          59d726222ffc846ada2e7c6d040e0f0114e2cb92e72f81f23489aa6681b07a1c8cfceb7e81f9b7d7678d33b313302d9cf39c345d862e43f2768e145df14ef8df

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_459522CFAB1749B8BEE0B90DAE653167.dat

                                          Filesize

                                          940B

                                          MD5

                                          44b87076e98f4eda3393f800003787a8

                                          SHA1

                                          d27f203558974c8e81f6dea44f88742ba4f09937

                                          SHA256

                                          d251eca60f8583f9290a0dbab26fc1975a46004b07ae7665f3de19676c9085cf

                                          SHA512

                                          65e549b413238ea596f7cb1fceba84d5ffdeaae4d390f46405ab9d19b446b8fa8ff5966214731d8815bf7e91478bf3d5c28d76f41322a50fd83bdce099b3b5cd

                                        • C:\Users\Admin\Desktop\Lock.BlockDisable.3gpp

                                          Filesize

                                          1.3MB

                                          MD5

                                          670ce5c4194d87a121da131c94358a4f

                                          SHA1

                                          31cf54a5879cd4f379e8d0b2ba73632d3ba2d50d

                                          SHA256

                                          79c98dc33dab24dd6e2a542bf4e4bc79d4932de2b45d40c197b2dbcf813cc35a

                                          SHA512

                                          f2f56dc49224f9f5a67db7061b1a5a02a996303efa5c1c760a7b4151e9db64614ea651dc1c64c8bff2a367f7888492554a9cf2f07b99e78ffe0ec6f9b5d44de8

                                        • C:\Users\Admin\Desktop\Lock.CheckpointResume.M2TS

                                          Filesize

                                          765KB

                                          MD5

                                          ae316fb88b863c54a29b0e15f6b5662b

                                          SHA1

                                          d5e94a9b252ce49069323abd08b8b5bbe9975b9c

                                          SHA256

                                          9a892f18339dbbaa0e13ad1dde72069dc799e6cbfa7fe7875c4649cfaef0fdf5

                                          SHA512

                                          4c544a5b3a5613dc1f5b7947b9e64c080e055a954dda845dd5d0b29122e233808329ce949559961d3cb316549b905fc68206b499ab1096d30db284f31712923f

                                        • C:\Users\Admin\Desktop\Lock.ConvertDisable.rtf

                                          Filesize

                                          465KB

                                          MD5

                                          25ebc43b01f8fc8a8ec7f1204cfbbe5b

                                          SHA1

                                          61b5c8bc88c0a9635e4efabebeef7a7cabafeb00

                                          SHA256

                                          2018eaf0ff87a5eb0f131736fb190d30f36175b5b3a8bdba0be32fee14fdcf83

                                          SHA512

                                          bf0ee465bb9f60676ef9ef7c68ee53f315e01b6b4a9a4cabbc431c894e3f4c59459b41f664f316230c27462212da4a749bd43b634e56f55f5c2a41481b111bab

                                        • C:\Users\Admin\Desktop\Lock.EnableJoin.vb

                                          Filesize

                                          565KB

                                          MD5

                                          2cf2f59713820c90fa1f7754ce5d7d5d

                                          SHA1

                                          352385b66908d1487ab618cf978382c47c9cae7b

                                          SHA256

                                          1dc2776011f24bb4b7b73175a124dd219276993746865b6b597098d60a1b26a4

                                          SHA512

                                          83e0323bcde52c1e869d8348c1d93de2ddaa774b656719b1303445d6792a68ca6502294fe2a046694f9203853a092751f290e6174ad5248e0556848f649a96c5

                                        • C:\Users\Admin\Desktop\Lock.EnterShow.htm

                                          Filesize

                                          632KB

                                          MD5

                                          779e919f02e5aaa87da21602809c398b

                                          SHA1

                                          0233e9db3bafc83328bf486dfb404c0c55e3c31a

                                          SHA256

                                          27c4265036f936110ecc6d7be19656b708728eb1751bdb4d7c1e9fc1d601abd8

                                          SHA512

                                          dc9eae7db3eaa62e16c176e9f17d6394ac887ec10e0f8eb12f4855dfcd729627b5789a28c9f7f10bac5e23b99b3b4037f1fb5a84cd75072789d859dcfbe3b363

                                        • C:\Users\Admin\Desktop\Lock.ExitWait.jpg

                                          Filesize

                                          332KB

                                          MD5

                                          8c6e4a130490884531ba75b7bceab2d4

                                          SHA1

                                          d75228e8078f78589b6135695be4d4daf11ae214

                                          SHA256

                                          b3282350b4e22b2945278ebfe4bcb43c6d30919d9ff112448db042d7dbfdc2ae

                                          SHA512

                                          43fb43e7b073de89cb210ff50257024e9798c778c75f6bca2c284a0406913d1f1c7b4322f4f3a30fb42db61e9448c53956d556b0ca5eab8d85c3d8f4d4c1f3ce

                                        • C:\Users\Admin\Desktop\Lock.InstallSend.ex_

                                          Filesize

                                          865KB

                                          MD5

                                          f5111f27b4cbf404f5c6536bc1d95fd2

                                          SHA1

                                          c353dd920ac873b3208f62da1715053d6dd9386d

                                          SHA256

                                          5819331f3f938e2a3660e892d8cab9f6a608c42c5f81120b5961aac3181213e4

                                          SHA512

                                          c3c739ca37a4923d828e5f7fbbf88ab6c1974bd49fa8eab08aeb08d87a8f6585734276ba51b0f85a2b7b2d9e51b223b76ce9a0b0f2e6dfff1a8853ad02ffe693

                                        • C:\Users\Admin\Desktop\Lock.InvokeJoin.dxf

                                          Filesize

                                          931KB

                                          MD5

                                          4df3abe315463a30290973be76fb21df

                                          SHA1

                                          ec557364209deda25be76a76d39ed6602fc78e3c

                                          SHA256

                                          be4c50325063d823c3bb7a0eae2ba97fcf715e3b29940dfd818a9ceaaa10bb6b

                                          SHA512

                                          0877e14b61c1b9328f52c2dea45754509057280c942796eece17881f70c2ca0ca794fb48333eef57b2b62198343b62791dd898e23758cec140abfa7f3b1a9f4c

                                        • C:\Users\Admin\Desktop\Lock.LimitInvoke.dwfx

                                          Filesize

                                          399KB

                                          MD5

                                          13686eb144b2e83ebf4ce666f58caa6f

                                          SHA1

                                          81dab857f42f666750ac5f22e2ab479d3aa25e2d

                                          SHA256

                                          633a9d216ab944c184d72991e2b6b37d3c4bb01287fd35c72155b5c02d11496d

                                          SHA512

                                          75092ba7c4daaea299b798a84b7ead9185461a27f2f3314306e910361eb62674d73006318d9c6d90f00c0cb72bebf4cd253e9d6b246cbf36a29926049d0da724

                                        • C:\Users\Admin\Desktop\Lock.MergeInitialize.rtf

                                          Filesize

                                          599KB

                                          MD5

                                          05bebbfa268b3fffd856c60021293cb0

                                          SHA1

                                          732b03919b19ed0f3f1287ad66f93a4184847031

                                          SHA256

                                          f303032b6012242787b672785c5df67b85d4e3c1a3791996f0252a7783d6d79c

                                          SHA512

                                          96953cbba7bba846a2e4da6819a6e54cd11a46e482f0e64f92d25ca72e98981160164e72442a5c78722faaba9009b4f52afbf1e8a698c4a490520ffdc7072e57

                                        • C:\Users\Admin\Desktop\Lock.MountInitialize.ADTS

                                          Filesize

                                          698KB

                                          MD5

                                          10e774d33b41b134558007f68c0a1f13

                                          SHA1

                                          0edf654313cd4eca438a6ef3e26662189e48fabf

                                          SHA256

                                          19ffe4e3295187024c02e8d79a8db623a8dc3f1972054bb9b787ea4725340177

                                          SHA512

                                          01da0f41c820aff2fdb9c1ca38dc5827be149ca8ec6be86ffc68be88d5cf8267adb3bcf18c84b5a941397e8856983f096952a9a06353ff520d3c1d262b920c3e

                                        • C:\Users\Admin\Desktop\Lock.OpenSwitch.js

                                          Filesize

                                          432KB

                                          MD5

                                          1872816f38ed9fc5cc81b66630d3e166

                                          SHA1

                                          b56c195fd326c50f73b9afae8612df630236a246

                                          SHA256

                                          90df6c104bdc99cc417c1897a3474e17aea38d7b23121a2a8e3f77a5f108ef85

                                          SHA512

                                          0165eadcfccc41985cf63f60cff365a0536f5b61558630b1c7e31ff87d3b831402d6679622ce0644e28165f3a8eb47eb024b1c097f7f2c85f272e1de8880b6a8

                                        • C:\Users\Admin\Desktop\Lock.SaveHide.png

                                          Filesize

                                          832KB

                                          MD5

                                          3b12dc2b8f2fc1f192e7f820a7bad014

                                          SHA1

                                          cc49e98590315a3f4b0bc19d115a60f8c5eb58d4

                                          SHA256

                                          d61724e633feac5099e4ca4a728682697d6ac40764cad414e276f93bd6d6d51d

                                          SHA512

                                          3203edb10b0e70ffaa22712952bde28c3e7a39f09e820bfd5a1ffd061b9587c1a5db6324b5b8733ff1c41813aaeb8e7f4ddb0d5c07ac3a94cfd96b815014386c

                                        • C:\Users\Admin\Desktop\Lock.SubmitSelect.ex_

                                          Filesize

                                          366KB

                                          MD5

                                          144730898b5536c7b0bb9e048f77ecdc

                                          SHA1

                                          03f63c3af37985da98253a7b40883926b9f0b04f

                                          SHA256

                                          8b526a9f0c224182380ff9ec9f324bb7d6537248961949efdaf039c394b945b7

                                          SHA512

                                          5e0f4b1741b12e9df86b311e2c1d5479851342abce4469ad5cbda55c5155623eb2d202019d822159d4a7b9ee8e692f2c33e45775e14ebc61e338d44cb8e807e9

                                        • C:\Users\Admin\Desktop\Lock.UndoSwitch.au3

                                          Filesize

                                          732KB

                                          MD5

                                          7ff6e96db392fda219fe60ab85afa4a5

                                          SHA1

                                          d654981f6493fa2b2541b65ecd4731f96421f971

                                          SHA256

                                          1de1c4f8ff019af1de36a5a89ca2f2722962bf7d661ff67570b9e8bca55df8fa

                                          SHA512

                                          3f3fa4eb6e3d0fad544fda8908b9a8785fa827cfb12a5ac75ef12f3c3954e4732bcec6e3aa561cade899dbff95bfb97aec85b066259abd3bebfc8da4554cad4e

                                        • C:\Users\Admin\Desktop\Lock.UnprotectSwitch.avi

                                          Filesize

                                          532KB

                                          MD5

                                          20e48da4e87fca3be6f53f3e770a56d4

                                          SHA1

                                          c927a481278fec44c37c12ea1ec56aa0c5ad183c

                                          SHA256

                                          4e3a1316f36fd03d48c74d36107db5dcb12edfb6e44a800c1e03350d0d1b3065

                                          SHA512

                                          862e1800e7730b1036e58cd692e08f5a9b125a351f19c73e22a5efa8ac4facc5bc7d17eb7832ed391fb88e59d4d2bc40a59136994d52360920f1f6b225c95e6d

                                        • C:\Users\Admin\Desktop\Lock.UnregisterExpand.doc

                                          Filesize

                                          661KB

                                          MD5

                                          93bef71c4d5323f73d02956b9ffcdeab

                                          SHA1

                                          3d8a46b36d846dd3fbdaeff5af5f3e37c92488c2

                                          SHA256

                                          ede62e14b45cbca864a41faeaedc684911d220207d660dfb1cede8c26879505b

                                          SHA512

                                          a39d8846b3aaa7f2381d3ffc0bc73248bb322d584a6f4c6d902248530b5ff2e87f889d0abe473c9a81cd3a2cbf0046f435c6ddb6adc9beb5c98db2b37fbffa11

                                        • C:\Users\Admin\Desktop\Lock.WatchConnect.DVR-MS

                                          Filesize

                                          499KB

                                          MD5

                                          cbd97ee42eb43c4ecab3daf8523d81d7

                                          SHA1

                                          7a466c5202f59cea78a14ca9834e049fa722139c

                                          SHA256

                                          49c07abacc76819b319de36a42a5acf899380045e176d88dc6a769530450210c

                                          SHA512

                                          c39c53e9bab188c9c38cf2fc319a49399c64c5fba4c301837d44568f192bbf44a5b338f09b6814a1d7e5b5dc1237267f373362b1757cc9fed8eb71f1983d5933

                                        • C:\Users\Admin\Desktop\Lock.desktop.ini

                                          Filesize

                                          288B

                                          MD5

                                          ba41cfaa9aff58c3b40c7ac73b4d1cd4

                                          SHA1

                                          691f19d9330522a47b16c832c6d6b51a3a2efc72

                                          SHA256

                                          30fb6cb48d4689a02731dedf82483a58738ba4131e4be90b2a44bd1ab9fd6a0a

                                          SHA512

                                          708ebe3314fd85d51ab0e73d83a7e61cb00d6c0ce5e78530f7ed6c9e6bcd827ca5b3ca4cd34842bc2d7337fdd73c4c1f39407f5e8c94ba6a5fa8e9130533350e

                                        • C:\Users\Admin\Music\Lock.AssertClear.tiff

                                          Filesize

                                          460KB

                                          MD5

                                          ce4181f7704f6587acc916d412310594

                                          SHA1

                                          0b96c98ac284dd647f287f1713e8830eb7f77383

                                          SHA256

                                          3769d6626332dcb313093b9d6d4c02eed7ec735e456b9317a85d66641a043696

                                          SHA512

                                          e2a56ff5f65d0afddf96c0c4cbe3c58e3e1b6c3533eb420803f9bad293f61fd1fd6528c8cd0f3dd065d555a6ee4b0495ed2222352df6e7cb6e837fdabba29d04

                                        • C:\Users\Admin\Music\Lock.CloseAssert.scf

                                          Filesize

                                          523KB

                                          MD5

                                          95e18724d3bcf477d57cfb90dbb159b6

                                          SHA1

                                          1bfa67cc71ee4403afdf809dc050f9bba9e26993

                                          SHA256

                                          de48fbc0186f32b16a7cf7008d5e55110e005301eb2b761197c7acba8dc96cbe

                                          SHA512

                                          71586748185d2a15ac8be39602284182d6dd58b93db7a9804dca603ecb3a6caf4d7a684b87234ea846120ad756f1e6c7333b56ac4af552ca49760de7f59ba5b1

                                        • C:\Users\Admin\Music\Lock.CopyRequest.TTS

                                          Filesize

                                          605KB

                                          MD5

                                          1e6f1502f6f316a0089f1afea42c5e11

                                          SHA1

                                          6e905bd5e1b2776a532a5ed9a104042a608bd303

                                          SHA256

                                          e9a641985c6bff968da64e2dfa44fafd6777d5c9dcf654515151e0ab206d0b4a

                                          SHA512

                                          8a036f9ff4d6c1205655bbc27f8bd61ac653070cb3c2b96439445b26b03d7f77e7271ff20c4061737236b30be77026a637ad1001c7bfd31e9361cb0c0bae0ab3

                                        • C:\Users\Admin\Music\Lock.DenyUnregister.shtml

                                          Filesize

                                          412KB

                                          MD5

                                          bb5dc44b3ce2b78acc226129b3a0ae20

                                          SHA1

                                          ef9c74e219887916767c3c3f193877ea92af68b4

                                          SHA256

                                          6852b8d34c5990444ea9897a9c394429fd629e7ca563432ce7703d378550f5f0

                                          SHA512

                                          12dc871ed50fd6c55819f9b98ad62c919cd3c4863d2cf66ccb54b959e317b5516ecd62e4d890fb0bbc6999f4201b97304259e60816581858d86aa454664971c1

                                        • C:\Users\Admin\Music\Lock.InitializeDisconnect.vstm

                                          Filesize

                                          363KB

                                          MD5

                                          6fe6a8d3965adc7ce690c5f175dd59e0

                                          SHA1

                                          f37f1b47e1694b7b33213bb8c9f223650913f6f4

                                          SHA256

                                          03f96d5f7d70289f2960930cd26fe6fcc3d5484e08556f582c40e5a1de9e2bcf

                                          SHA512

                                          d9560ea2a45d391d2b20a4dc9fbd54ea46ab2a40145f8e59ab26b34eb5d97c7baeb0cd057eff89d06349445ab9ba815c5c112dc488a4ce71b211aa12abec427f

                                        • C:\Users\Admin\Music\Lock.ProtectWatch.bmp

                                          Filesize

                                          508KB

                                          MD5

                                          1bf6d374ac487ae79530b7c9823eb2c1

                                          SHA1

                                          70547affb6e16ae9da40a81fb09919a0f25cd047

                                          SHA256

                                          82a9bc9193914f244878b5a09b10d1f4a4ea30af3d8c41dc8620e545b5e718e4

                                          SHA512

                                          e46b1463b46256ce415068b8362da7a2267158b449d3a9928fab8dd7226d201178bfa4f256a6257008c3f0ef8383a41bb6f3b5349bb595a71721f8cc222ff9f7

                                        • C:\Users\Admin\Music\Lock.ReceiveConfirm.zip

                                          Filesize

                                          315KB

                                          MD5

                                          17e177157508a2a2c2e6f8ce27a3d8a0

                                          SHA1

                                          bf6b4866c65dd6f4997ac180b9d95ddc89f47f80

                                          SHA256

                                          ed40a8ee9117bb8f503a2cb353a26d31758336204f42a67ace01acdff1fff36d

                                          SHA512

                                          db1de8098e56cd7fbf66a345faca50c380fd04213648eee438aef70300515b7f2db076d555ef908077674e72ff054a50987d354a4a1bcce23c07e8491fa910b5

                                        • C:\Users\Admin\Music\Lock.RemoveConvertTo.nfo

                                          Filesize

                                          448KB

                                          MD5

                                          96b5a3678117daa1e8862134b892f5c6

                                          SHA1

                                          0edc6d3aeff385c3ec6888c8e9a2a79962273446

                                          SHA256

                                          ba90d46df1469eab5793b8acc4a4d0fee2ea8a712b961bac35e313a7a553f920

                                          SHA512

                                          3daa36dc5a63edb90438ce317372e17778ed1642fd07bab12f2fdd63e687c4fa8391396b98aea2e67a4da6c0f0b9c23c58f3c57207f07cac3b347b2816f4483d

                                        • C:\Users\Admin\Music\Lock.SetImport.dwg

                                          Filesize

                                          320KB

                                          MD5

                                          59c04cad3316d960ebcc400b5c96843d

                                          SHA1

                                          e5b6891bedc7a2ac7b1b6b9bcbb061edb005754f

                                          SHA256

                                          8eb88a3a7d0f55d627272b56d54e2648737a76e95cf4777ebcb7cea563df6909

                                          SHA512

                                          9bd15882cbb64653372172b0fc16fa9ca8173f0ea82cdb65b230da55c982e357a6d87c0c22472de2dd1379d5bc7e14c3345e0e59f7acc1b0521adb209b89492f

                                        • C:\Users\Admin\Music\Lock.SubmitComplete.wmf

                                          Filesize

                                          354KB

                                          MD5

                                          1e91c983ef561e87d3829fc9ed213b55

                                          SHA1

                                          265c693d29956ac9707553dcbbe34fa8b3f6f41c

                                          SHA256

                                          5679e3bfeab5cd9d2df8ecc0fe7db8bb47b2bd9a2921d9140ea35235fc5f0c37

                                          SHA512

                                          b6a2c68be9d800794853be8b669bac3271f3b19743c3ebf321ee76767d81dfa256a116824b9181e8ed79f2a31cbafd49af48e7050f86fb4c34364f152533eeb9

                                        • C:\Users\Admin\Music\Lock.TraceDebug.ogg

                                          Filesize

                                          702KB

                                          MD5

                                          a46c29c847b9a8fd734d0e5be13939e9

                                          SHA1

                                          1ccafda04fefc719ebf8805bc74ebc9943c386cf

                                          SHA256

                                          e423d06ff02aaa9242c9ef064ed41d7e86a58eb0085c3efa545b108e9f6e8a33

                                          SHA512

                                          4f1e33145d0767fb65b7f7a19da2cafb700c15319354f9c30c943a09da1883a4913e1c8fc4734315842f1de07d5694dfb44e6dfcac36b1ae5b9a1ddf924fe40b

                                        • C:\Users\Admin\Music\Lock.UseSave.mpv2

                                          Filesize

                                          257KB

                                          MD5

                                          ec6d5b742abfdda78e238aa765e4c6a0

                                          SHA1

                                          58c1ffb9a73b46f95f489b15d2e4f6d889c254bf

                                          SHA256

                                          3da1657aedd3a02d852903421b3e1d992159801eaea77efffa6f8746ddbaa552

                                          SHA512

                                          8deb8bcd44a6a42d52ead117f6d60427f2443ff5b2472600882f633a8c970c4c638f0ec5c75684a3cabaa0601b6bf9df33e42fbef0f2e657a0ebaec0a4479b25

                                        • C:\Users\Admin\Music\Lock.WaitUnregister.rtf

                                          Filesize

                                          128KB

                                          MD5

                                          e371d4e66cfed323c34d3de48e89876e

                                          SHA1

                                          c4320df72cc46cfdc03db7548a7666322aafc851

                                          SHA256

                                          2adba86e1d85950569faa0b5680c038b68c84f492630f5429825468ada0e0fd9

                                          SHA512

                                          b2d799d48e3be8d6a0294d9d9f884ac3fab98f08c86c824af83530df56f93f90a3f9b5bd813028471c43f8ef85fc608dab29ad6c24471066b05ed473d01076d5

                                        • C:\Users\Admin\Music\Lock.desktop.ini

                                          Filesize

                                          512B

                                          MD5

                                          3e5d2582a5d0c915afef6c8cafa343d1

                                          SHA1

                                          7062928a2ec000838f78dce8c48693a1859471e1

                                          SHA256

                                          34ae08d15c34e017facda7c39f7b5f9e8cc891b160072b908969a1a2523772aa

                                          SHA512

                                          2cb2f561be74448d361099883ea4fdb9a1ea17a82970459fff7e35802617726561b52955b147d5fb23d3a3bb3d88539af645886c2d0e46716fba5c641a2b90b7

                                        • C:\Users\Admin\Pictures\Lock.CheckpointExport.dxf

                                          Filesize

                                          128KB

                                          MD5

                                          0f0e2dc6c864ff9c249f7b2fd01b5d05

                                          SHA1

                                          8f4d3030d885d441fa728dbb9e266e49c57f8fc7

                                          SHA256

                                          2ba9cdf9f101dc7cd11ebce84d61eb03246c0da045c9dceb6c2e489105452a8e

                                          SHA512

                                          5b13dccaf7393b1f286533208a0468da34e03bee08e6a4af192743941b03b04aa0bd9bf0d618c1d51269f1e329ee2aeecd32b4a2a829576a2c3a2d3bcbe15000

                                        • C:\Users\Admin\Pictures\Lock.DebugHide.dib

                                          Filesize

                                          128KB

                                          MD5

                                          c5e7138589ce54699c29de21e69ab781

                                          SHA1

                                          3b4d951e2f92ecf092fa39d1615ef2cfd2c8d915

                                          SHA256

                                          2cc6182a2328b3d65a16ce4425c4cacefcfaf4bcb398c06479f5183fdb5dd0e4

                                          SHA512

                                          4e1f1108e70c6b54fbc3f0657c0328ad1bf9d78fa3b044b26152c7258d33ca9577cbb555eafee2fc6716b55658269e9645ae5cbefa65d22bed4dbeb4f8914c93

                                        • C:\Users\Admin\Pictures\Lock.DenyConvertTo.tiff

                                          Filesize

                                          128KB

                                          MD5

                                          7f4a73b8b8e8f80c0ac786f6a973ece7

                                          SHA1

                                          e55e9e4f8e52077b801c82c27aa54c433a636517

                                          SHA256

                                          7b613b39dbb4f685955a1a3d60f7069125f9d50cc177701ea588488e38956a22

                                          SHA512

                                          a1ce5284f5059a7137a63f8272cb02389fd6d0a84cb82f20c63aea77827c1e9449f30c6204a24408e1c1ccf99ec7c1907c7ec4d41dce2e2a34693e05cb53edf4

                                        • C:\Users\Admin\Pictures\Lock.DisconnectAssert.tiff

                                          Filesize

                                          763KB

                                          MD5

                                          4176f03c5422b607fcb8bc65bde57d79

                                          SHA1

                                          55a18634e6993f98111204e290b0feaec1cb640a

                                          SHA256

                                          4bcc3dabe723f053c2b1bf75ac164023fb0cb38016b26601dbd38a4ced7f0345

                                          SHA512

                                          8089920ced1f5c69eee9856ed11c399610e6483e2c61b91dfb93a86b7dbe7af540b42d965b069fccbd06c1e5f79e2e4dda1f353d89dc3d605c7b3a0197b06ffe

                                        • C:\Users\Admin\Pictures\Lock.FindProtect.tif

                                          Filesize

                                          593KB

                                          MD5

                                          42a3e6336f95a994f1291afdd61da731

                                          SHA1

                                          f344ef09048fbd00b80c02142761ecb286b08195

                                          SHA256

                                          492d9ad266efeb68f28a5ce7208852a3fd08f551ab2243169128aae0c24b3625

                                          SHA512

                                          7ff4ddcf969b413da3f06f907c1451284b0e8e9077b84f6fecb69d1afbf11e557343e580fcdc69ffe617ec33f6214dcbdcc81e1dfd485f9ec7ee4c1fb17731a5

                                        • C:\Users\Admin\Pictures\Lock.FormatSend.svg

                                          Filesize

                                          678KB

                                          MD5

                                          fb7554a8e649d2101e5cd6d87aa4b6ab

                                          SHA1

                                          a31158fc6bc8e6a25f9d5ca8c5cabe385e320263

                                          SHA256

                                          dba95bb0472e5eaff3c56983b9fced8dc179cf9a57d6f4128dc72d8d97329e7d

                                          SHA512

                                          209095ea49097d116be4736853ac11d9b60feeba89c9050b81b27f14065c22f3c897eed4ed51d9ff2c5ae2761ad88de9765cf0bf3158f697e96b4fb281aff6f6

                                        • C:\Users\Admin\Pictures\Lock.GroupSwitch.svgz

                                          Filesize

                                          339KB

                                          MD5

                                          1a98bce6b1dfdd56e3c12f31a8b0f764

                                          SHA1

                                          31bdbce586ae20443b08ff33e0147d658af7317e

                                          SHA256

                                          ede6412dca7893b2dbdb17d26c39ddd626401e632e2acd9844aa1d19b4cc0e6e

                                          SHA512

                                          183220f947a071f448169c6c5e76526f6d189e8e295e9ab1c9a4c59ae2cee1f6c515a3fda47ca75466d5fa028c50e17e3d9f3842b86fda55fc37673d43386c7e

                                        • C:\Users\Admin\Pictures\Lock.GroupWatch.pcx

                                          Filesize

                                          318KB

                                          MD5

                                          62d1e273292b740f90eb8d602055552d

                                          SHA1

                                          56be959b70a6e97ff37e96a8304178d0612fe552

                                          SHA256

                                          d8823df9a0f7f738294032d3886c977e8ba2df7c02933e9e3bc7974992f9eacd

                                          SHA512

                                          d492d583a58c1b5987bd0b775824afad19e85ddeb90221ed2b6a4fd79c4b86b55d847f705b9848b9f54426b374d4b1659e9ca992861c8f1c67e245173eb1ec4f

                                        • C:\Users\Admin\Pictures\Lock.ImportStep.gif

                                          Filesize

                                          721KB

                                          MD5

                                          b3cac7b65e4e77fcc2d7f58c1adee71b

                                          SHA1

                                          cbc729f883649e8b0d9744e75e3498150d3e0893

                                          SHA256

                                          8d0a9f8600a1514359815715f2891c546f3b90686f9764a83c8460bc99cb5de0

                                          SHA512

                                          b95831276a6879d0f4f72150f05760a6f3770f3d8e8c81a4e451edbaffc494bd413c2255b971b1b6f1f324dc83be80803f85039c761176df9c6e79db6d0e0e70

                                        • C:\Users\Admin\Pictures\Lock.InstallUndo.jpg

                                          Filesize

                                          784KB

                                          MD5

                                          c108ab58f18749e5ff1792e421f2307e

                                          SHA1

                                          d8a06702eac850bf284ae75c9172403a852255e9

                                          SHA256

                                          530d11fe1ef783b2addf0a65d76a033664304352b9ac7606cc657dab4c8b5fc2

                                          SHA512

                                          c325a726239b441b6eea09e87bb40f03aa8a01bacfb59de2db1bba393b670e445f8fc44ef5f5a685d5a7762d93d339ce07e278f787d2b6332879fa870e0a0f94

                                        • C:\Users\Admin\Pictures\Lock.InvokeReceive.png

                                          Filesize

                                          296KB

                                          MD5

                                          c089cd2f24da3c201b1141da2eb5961b

                                          SHA1

                                          97718822cea7a7a889c54d794265f63889aeab6d

                                          SHA256

                                          e8f1129d8fd943ac5a547d5418fa6d5e22486a556d981c84e8ef8a436c426b89

                                          SHA512

                                          0a61229fc14685f6bc7542b3d50304149600cd4124d92e26e005c248d3314865dc309d3b0ffa9bd84a1be2d151bded776cd2dba71308608d9a25b5b6083386ca

                                        • C:\Users\Admin\Pictures\Lock.MergeRemove.jpeg

                                          Filesize

                                          508KB

                                          MD5

                                          e06b2e7ec8cb9e94336e356074af7b78

                                          SHA1

                                          d3a0cd8bbe45d508196d364d16c2f00350da0404

                                          SHA256

                                          aa1fc0dfeedbc5ae3c28ac124f7e7cc29630965f5df1da37fb294f888f88e870

                                          SHA512

                                          ac9515ec73dab9d4e695c83abd69cdb5468ad781dd782cbe41a6dda418fa96de121a547d16f59c20dcc877f0a804918ee0f8310a6ff034e72129ac113bdb2b9c

                                        • C:\Users\Admin\Pictures\Lock.My Wallpaper.jpg

                                          Filesize

                                          24KB

                                          MD5

                                          1b7ca3a5440ca77da9aba7b158022c3a

                                          SHA1

                                          62d6d1ac8c57ef5c44b3cca15d63bf4868e2eaf0

                                          SHA256

                                          c415a2920a393458b1f36fec018094747e4352dab5c60a0083d6b325eea53640

                                          SHA512

                                          f40b728afc1662163e3f248cce074a199f4ded69f911982ab71cc20a5e3be0eef56fd6f7cfb144307d5833b283063f58794cc9d9d21295c5457e6c6d8e68e6b2

                                        • C:\Users\Admin\Pictures\Lock.NewRestart.pcx

                                          Filesize

                                          466KB

                                          MD5

                                          01dc54d761bacffc7f71e42a07fb74b2

                                          SHA1

                                          4e110677d859737503d2b62610db2c25325526a7

                                          SHA256

                                          4a05c6f7362c987a312f23dff9a1429c7b0c7637a2dcc8067f8a6327b65b3619

                                          SHA512

                                          170ce652a7eed16d29e029048a29bccb04d05dbbb774b125b9dcf7dfd48f48c78b0a0527b0eab5df549b0a0822d4d7c7287432e7d078373b4b6a889006b73147

                                        • C:\Users\Admin\Pictures\Lock.OpenExport.bmp

                                          Filesize

                                          742KB

                                          MD5

                                          63db378ef5691008e7f0ff77ec5a4374

                                          SHA1

                                          12c7bc7ef5723f1a50371de0bdc20ed53eef1b6d

                                          SHA256

                                          601d6a8c25023295925248a5982f7d166dd188ff37e82c445f4209d2f75c251a

                                          SHA512

                                          0b41d57e1762935a0c8a18dfcc31c3ae2406da613a95db44f8d1cb8b236fa8471abc3f97eec05f7f7ccfd36f2dbd1fd7c93b15b3149598e744a4425bb7f18132

                                        • C:\Users\Admin\Pictures\Lock.ProtectRead.pcx

                                          Filesize

                                          487KB

                                          MD5

                                          f4e7c810cfd95a2d4886196e7a8ddbef

                                          SHA1

                                          b70b0e3a8eaa9362247da96c3f003e2c26415a42

                                          SHA256

                                          25da1942da4ebfda3e9f056b3f266bc7bdf6204d25bdbfa88676b016ce01dab3

                                          SHA512

                                          879e93cf31b397a4e9b17b69d6486cb7522df3ceb8760b5a4f2d7ba5dcd32d2b53b186c04a0affad07275b907c6275617b1f4514b6d11489b59cb236a647cadc

                                        • C:\Users\Admin\Pictures\Lock.RenameResume.dxf

                                          Filesize

                                          615KB

                                          MD5

                                          66db7a1cc9137b0a2e3cf95185e469b1

                                          SHA1

                                          819b6b801c17f4b68c2daac33fc7cb72426794e6

                                          SHA256

                                          e0b77e7e459bdd6ac3e4983193a6b83510784eec83ec8c57036a8fc227f8a818

                                          SHA512

                                          f3f1672c9288775ad96961bfd02355bef11604728baadc5e74e8aaa8234a273f205e5ace788d1a308a0d1cd596fd336a9900fbf6d4ceefdafdba6d3cceee14cd

                                        • C:\Users\Admin\Pictures\Lock.SubmitDisable.dib

                                          Filesize

                                          530KB

                                          MD5

                                          825cfea353311864100ca8076040a1ce

                                          SHA1

                                          161a28045a2b126b9adb877b7a053e4c0c4d1402

                                          SHA256

                                          c3d35c590b3ed8986500483614f76332f80900f01a8e149cdafb86cf5fad918f

                                          SHA512

                                          b01ec5b024a44a9adf361c469709a661e4cc5364dc18c7b883db0d9fabc63896f807c24bfeda639a6a37b2fefe79308b17a0f1f6a5ffd392d3f6fe974994b611

                                        • C:\Users\Admin\Pictures\Lock.SwitchWrite.jpeg

                                          Filesize

                                          572KB

                                          MD5

                                          40f31a5d05de963ffe25d928382a3b25

                                          SHA1

                                          f407ff2bf10a6aba7568058198a0dadeef48d132

                                          SHA256

                                          b173172cdb720529b761a8ede8f253c6afd5fe2dd838c236c4c25a3eb27b9d11

                                          SHA512

                                          ff2eecb7252bfd4b2186facd9ab92b3eb06800500b745a66acd16024f90ac8b2f2e4f573730d74bc79856a30e67d80d931cf21ba5eae8eb1cf4598e8ec775df2

                                        • C:\Users\Admin\Pictures\Lock.TraceSync.png

                                          Filesize

                                          636KB

                                          MD5

                                          e51770b73c22c76ea51a988ab04d5948

                                          SHA1

                                          56f2fb409015a8b37069a1c5e774267db7b0835f

                                          SHA256

                                          62bf0865003ce56a745cbf45d8ba50310ef5c65e5ed0c1378a652edc3701dedd

                                          SHA512

                                          8613c61bce68749721ec46a80c88c4a471465f8d6f56873c033febe78561481fb24d8db7d971365975ca6f0c37db986b261be106027b6678b1468131eabe9c71

                                        • C:\Users\Admin\Pictures\Lock.UninstallUnprotect.jpeg

                                          Filesize

                                          402KB

                                          MD5

                                          e8a956642311b524fbfd3c117ec5de66

                                          SHA1

                                          3f0b8189394abb0193820dc7f8112f358b295f83

                                          SHA256

                                          89111681ec87429bb45941a302712f1cd3d9cfa49b85ccc06f0080b55a1f3a96

                                          SHA512

                                          7b3643f2a67fd0bdabf5d6930428d36a43f4ef589a2c968c731486e4b3c6f34659e1504caeac9bc328c570711233b14a53fdd93a0ab68505ef85ad2e8a7e0864

                                        • C:\Users\Admin\Pictures\Lock.UnprotectDisconnect.tif

                                          Filesize

                                          275KB

                                          MD5

                                          41443f4b22ece1644cb267408fa1ea78

                                          SHA1

                                          0832b753dbec2a160c8023f5305276e540f3e06d

                                          SHA256

                                          23bde15fbd3962099365b5bb0e2cc62d4bcfcfa25512543ee28473f5a6d61e4c

                                          SHA512

                                          082e5a625f9bddfaeeb21b2ebb583e53d517d016d630a96b3ab786360332cb51b9b7eeeb2a84756d4b566eb6e5ebf61868b74b6c65fa007824b5f2df6e453204

                                        • C:\Users\Admin\Pictures\Lock.UpdateRestart.crw

                                          Filesize

                                          551KB

                                          MD5

                                          2720e9c59aabf570bc056392453291b9

                                          SHA1

                                          5f50a53171d423277d9e8ca59f49fb59d6c10ff2

                                          SHA256

                                          494e5c6913bc06ff06f6aeceae1dad855e0f04b5600a78581b7fa454f3f5cfba

                                          SHA512

                                          8303c9505c48282a9199a478e75e9b025742724c92990e15d07a1d403be92c148091be39e806252e08150fb52d4b2c23a68f036bb5e267dca9356ed21c0a9525

                                        • C:\Users\Admin\Pictures\Lock.WaitTest.png

                                          Filesize

                                          657KB

                                          MD5

                                          9f217e92a66127e03efe8bbd34d8f459

                                          SHA1

                                          d9be7f77eb3f2d644cd5e59a526c21e1466b37a5

                                          SHA256

                                          a00ffa9e44e492aac923589435605b08867d6879505fdff674e6eff7fc7b2be6

                                          SHA512

                                          3adca829d0eafa4bc362772ceacf079c072ddafa94be1ef6a75c022b5504d811f99a5e13537f9b1d56da3aaf47864801d3ba96b7332754d3f129cd2000d8ef97

                                        • C:\Users\Admin\Pictures\Lock.desktop.ini

                                          Filesize

                                          512B

                                          MD5

                                          82d46e91be16a17eb99f24cac1768f01

                                          SHA1

                                          d1cd482829c5e89d764a36af5db3b23535b0d8f0

                                          SHA256

                                          cb4e93277081095bdbd95f8bd745a80700689bc25483259ae9d970a2c72f076e

                                          SHA512

                                          a403d5ad7040fa10b999566ca1d417361d4e833ed2d91beb993c5d8f11ee4bb5263861075b484dfc999cc58354b1b0c071405fb993819431e0df6893e01589c5

                                        • \??\f:\Client.exe

                                          Filesize

                                          65KB

                                          MD5

                                          a85056ecfbf94af8efaa2e9dcec8ebb1

                                          SHA1

                                          f081275fbbdddad10689e185a750e1fd1ca0d0e5

                                          SHA256

                                          e00d04dcc4489101599f86df3956673c2ebcb8adbf05fb603266b91e9336b955

                                          SHA512

                                          c510e21e4d5b2b8fb2e7e902f74a6befbe20896490e607d640a2611020f20cede1d154e894fde5be8a6a2e564d2d7eb6d741d9b3ef21cdbefc5abdbc6a056fa9

                                        • memory/5112-14-0x00000000017D0000-0x00000000017E0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/5112-0-0x0000000074640000-0x0000000074BF1000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/5112-13-0x00000000017D0000-0x00000000017E0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/5112-12-0x00000000017D0000-0x00000000017E0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/5112-11-0x00000000017D0000-0x00000000017E0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/5112-10-0x00000000017D0000-0x00000000017E0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/5112-9-0x0000000074640000-0x0000000074BF1000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/5112-8-0x0000000074640000-0x0000000074BF1000-memory.dmp

                                          Filesize

                                          5.7MB

                                        • memory/5112-2-0x00000000017D0000-0x00000000017E0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/5112-1-0x0000000074640000-0x0000000074BF1000-memory.dmp

                                          Filesize

                                          5.7MB