Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-03-2024 01:26

General

  • Target

    b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff.exe

  • Size

    1.8MB

  • MD5

    a087201fb2f1a935b37ea293c7378414

  • SHA1

    91b97b7262e239b7db77451ec577cd4cd826f722

  • SHA256

    b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff

  • SHA512

    f226178958168825273bfc0550708974619c6f6c746a311b6af5284bd3dc01155778e0cde31866876d8a216de4550e4b951d381c74eb5dc8321284463ee8defb

  • SSDEEP

    24576:qcD/4AaCf/X4d4L00p5dKNhtAw6UJxsU0joPOpI8hI9wifeptCLbW5Ru9YwDp:R/4At/M4wW8NjATUzwBimpmyTw

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.137.132:1632

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 9 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 9 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff.exe
    "C:\Users\Admin\AppData\Local\Temp\b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2436
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe
      "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3516
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:2412
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4332
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4208
          • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
            "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
            2⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            PID:3936
          • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
            "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4256
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:2352
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5116
                • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                  4⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2056
                • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2304
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1772
                  • C:\Windows\SysWOW64\choice.exe
                    choice /C Y /N /D Y /T 3
                    5⤵
                      PID:1384
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                2⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:3928
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                  3⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3376
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    4⤵
                      PID:2740
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\930051783255_Desktop.zip' -CompressionLevel Optimal
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4288
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                  2⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:3684
                • C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe
                  "C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"
                  2⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:4792
                • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                  "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
                  2⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1540
                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                    3⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1176
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:2496
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                        5⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        PID:928
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          6⤵
                            PID:4320
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\930051783255_Desktop.zip' -CompressionLevel Optimal
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2728
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                        4⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        PID:4224
                  • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2740
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F
                      3⤵
                      • Creates scheduled task(s)
                      PID:4336
                  • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3928
                  • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1912
                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2264
                • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                  C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:4980
                  • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"
                    2⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2572
                  • C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2304
                  • C:\Users\Admin\AppData\Local\Temp\1000107001\redlinepanel.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000107001\redlinepanel.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2936
                  • C:\Users\Admin\AppData\Local\Temp\1000111001\goldprimeldlldf.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000111001\goldprimeldlldf.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:8
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4428
                  • C:\Users\Admin\AppData\Local\Temp\1000113001\32456.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000113001\32456.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4700
                  • C:\Users\Admin\AppData\Local\Temp\1000118001\alex1234.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000118001\alex1234.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3840
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2524
                      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                        "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4708
                      • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                        "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4832
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                        4⤵
                          PID:1356
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 3
                            5⤵
                              PID:2492
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                        2⤵
                        • Loads dropped DLL
                        PID:5096
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                          3⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1476
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profiles
                            4⤵
                              PID:1804
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\930051783255_Desktop.zip' -CompressionLevel Optimal
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1772
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                          2⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          PID:1804
                      • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                        C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                        1⤵
                        • Executes dropped EXE
                        PID:3004

                      Network

                      MITRE ATT&CK Matrix ATT&CK v13

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Defense Evasion

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Modify Registry

                      2
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Credential Access

                      Unsecured Credentials

                      4
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Credentials in Registry

                      1
                      T1552.002

                      Discovery

                      Query Registry

                      4
                      T1012

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      System Information Discovery

                      2
                      T1082

                      Collection

                      Data from Local System

                      4
                      T1005

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\32456.exe.log
                        Filesize

                        2KB

                        MD5

                        4fc4efc5dfceec7be0e7f71eb188ae8b

                        SHA1

                        8f6bb27659502894b0f606d7ae1a33a4f9eb85cc

                        SHA256

                        dd36cbe6a09e243b78e9d64409300a02faa5a4986559ffed4dd34469bf2508a0

                        SHA512

                        2d6a53d3c55d95db0039c5f095432350452ea48e97354a90981ff685099c4eb28a9d5edafa55d0b13c77c07a4e10fcaaa868c83de0cf569ea2161feb287c608b

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        Filesize

                        3KB

                        MD5

                        ae626d9a72417b14570daa8fcd5d34a4

                        SHA1

                        c103ebaf4d760df722d620df87e6f07c0486439f

                        SHA256

                        52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

                        SHA512

                        a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\goldprimeldlldf.exe.log
                        Filesize

                        425B

                        MD5

                        bb27934be8860266d478c13f2d65f45e

                        SHA1

                        a69a0e171864dcac9ade1b04fc0313e6b4024ccb

                        SHA256

                        85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

                        SHA512

                        87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\redlinepanel.exe.log
                        Filesize

                        2KB

                        MD5

                        47b3bb3bf3bd31854ef77da134dc534f

                        SHA1

                        79f7ee98bfce765215cb9bc54d6c27a748af50f3

                        SHA256

                        27bd7f1def6afae36983285feba3f689c7a006617a7d48cdac752bbd8ca39683

                        SHA512

                        f0d52c49fe5de3abd83875dc52755fbdd7d70aa92d31abae733a8104742372cee2f2e59c5b71f6d667144e52c97c543b095a718ea63410e1709f55b73b4953d0

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        1KB

                        MD5

                        0d0a491debdaef78b8d5662c9baa209d

                        SHA1

                        6aafccf0d3ec78adffd63419be80ecca1c504f79

                        SHA256

                        5699d20559e534de556496e6411b71394639777508c309354cc4754af1cb6840

                        SHA512

                        3a321d4149a878efc518cb4dab63427b4c3b963f7ae07653e2dfbfd9a01b25f9b9876098a093b4db69bdd4e2de6203ff7a1ac8afe298d9f764fb79729861e796

                      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                        Filesize

                        1.8MB

                        MD5

                        a087201fb2f1a935b37ea293c7378414

                        SHA1

                        91b97b7262e239b7db77451ec577cd4cd826f722

                        SHA256

                        b8eaa37637fff43be6e7eede97b562954bd4000a4772ea9f72a04165478cb5ff

                        SHA512

                        f226178958168825273bfc0550708974619c6f6c746a311b6af5284bd3dc01155778e0cde31866876d8a216de4550e4b951d381c74eb5dc8321284463ee8defb

                      • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                        Filesize

                        1.6MB

                        MD5

                        3a98ee18d71eed2470cebc176b44cde5

                        SHA1

                        aa68551003a0ee4c30c78141d0480e0d4496179a

                        SHA256

                        d1c855c825cd4cf177c72b1e1d9b356fab7373d15768f74f9f23ba1c54ed1ebc

                        SHA512

                        d9c7f4799b9379112deb70fa6f689af6ea88351213728c0390acf4a666b5b2aae09957f5813f91d348795da9c7fc28da0da6e559ab4b44017de7751cae66f307

                      • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                        Filesize

                        1.6MB

                        MD5

                        a7806e9a13cbea0e332d215c0e355d72

                        SHA1

                        f6a32f3b26d8f66ac05e20b2eae3b7061d516434

                        SHA256

                        a1a47d792027cabdc79339419a7a80fd98142e1c1f391c4fcf24b2501b5c598c

                        SHA512

                        d7c7bef2befe980a1ebb77ed88d68e476c48f0667ab2f03c87897360e9800b54df1280036250668b1a63fb8391ea932d7e6ade70c30adc382b94f04672b3568e

                      • C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
                        Filesize

                        162B

                        MD5

                        1b7c22a214949975556626d7217e9a39

                        SHA1

                        d01c97e2944166ed23e47e4a62ff471ab8fa031f

                        SHA256

                        340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                        SHA512

                        ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                      • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe
                        Filesize

                        464KB

                        MD5

                        c084d6f6ba40534fbfc5a64b21ef99ab

                        SHA1

                        0b4a17da83c0a8abbc8fab321931d5447b32b720

                        SHA256

                        afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

                        SHA512

                        a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

                      • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
                        Filesize

                        3.0MB

                        MD5

                        96e30514039a6d2eb543ff17d78d006f

                        SHA1

                        9282cf07964896e205acca228ef53eb04b41fb7d

                        SHA256

                        677305599382403e3b1a84119cc61ad6182775581c1f5eeb59a57793e49dd790

                        SHA512

                        429510f1cc5e41a6dd921b438ac11a9ad569d0a675439088b7ceef7b142b9d88e802cd36489d03b737d53f4275174e2c3728ba34a78639180e59aab146317f70

                      • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                        Filesize

                        1.7MB

                        MD5

                        85a15f080b09acace350ab30460c8996

                        SHA1

                        3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                        SHA256

                        3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                        SHA512

                        ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                      • C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe
                        Filesize

                        413KB

                        MD5

                        d467222c3bd563cb72fa49302f80b079

                        SHA1

                        9335e2a36abb8309d8a2075faf78d66b968b2a91

                        SHA256

                        fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                        SHA512

                        484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                      • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                        Filesize

                        1.8MB

                        MD5

                        eec22ed5b2a2f269fc2b96585f09e9d3

                        SHA1

                        c8f13c0804e9e980622b7657e3cec359e87f7450

                        SHA256

                        376ed655b53b7df00e2a4bd6898943b08c9e27031f2cfde2c028d4f012ef06a4

                        SHA512

                        fa442720b19ad3e27f10fdac8deed9bb0a26b1002981d205a50fd68389ce7bdb3504633c03517ea7cd305b062e7908a2bd8c1535d1b7b042f5705701f1303075

                      • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                        Filesize

                        418KB

                        MD5

                        0099a99f5ffb3c3ae78af0084136fab3

                        SHA1

                        0205a065728a9ec1133e8a372b1e3864df776e8c

                        SHA256

                        919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                        SHA512

                        5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                      • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                        Filesize

                        301KB

                        MD5

                        832eb4dc3ed8ceb9a1735bd0c7acaf1b

                        SHA1

                        b622a406927fbb8f6cd5081bd4455fb831948fca

                        SHA256

                        2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

                        SHA512

                        3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

                      • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                        Filesize

                        499KB

                        MD5

                        83d0b41c7a3a0d29a268b49a313c5de5

                        SHA1

                        46f3251c771b67b40b1f3268caef8046174909a5

                        SHA256

                        09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

                        SHA512

                        705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

                      • C:\Users\Admin\AppData\Local\Temp\930051783255_Desktop.zip
                        Filesize

                        22B

                        MD5

                        76cdb2bad9582d23c1f6f4d868218d6c

                        SHA1

                        b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

                        SHA256

                        8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

                        SHA512

                        5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

                      • C:\Users\Admin\AppData\Local\Temp\Tmp4AC0.tmp
                        Filesize

                        2KB

                        MD5

                        1420d30f964eac2c85b2ccfe968eebce

                        SHA1

                        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                        SHA256

                        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                        SHA512

                        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ptyveswc.dlg.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • C:\Users\Admin\AppData\Local\Temp\tmp46E5.tmp
                        Filesize

                        46KB

                        MD5

                        02d2c46697e3714e49f46b680b9a6b83

                        SHA1

                        84f98b56d49f01e9b6b76a4e21accf64fd319140

                        SHA256

                        522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                        SHA512

                        60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                      • C:\Users\Admin\AppData\Local\Temp\tmp47C2.tmp
                        Filesize

                        46KB

                        MD5

                        14ccc9293153deacbb9a20ee8f6ff1b7

                        SHA1

                        46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

                        SHA256

                        3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

                        SHA512

                        916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

                      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                        Filesize

                        109KB

                        MD5

                        2afdbe3b99a4736083066a13e4b5d11a

                        SHA1

                        4d4856cf02b3123ac16e63d4a448cdbcb1633546

                        SHA256

                        8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                        SHA512

                        d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                        Filesize

                        1.2MB

                        MD5

                        92fbdfccf6a63acef2743631d16652a7

                        SHA1

                        971968b1378dd89d59d7f84bf92f16fc68664506

                        SHA256

                        b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                        SHA512

                        b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                        Filesize

                        109KB

                        MD5

                        726cd06231883a159ec1ce28dd538699

                        SHA1

                        404897e6a133d255ad5a9c26ac6414d7134285a2

                        SHA256

                        12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                        SHA512

                        9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                      • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                        Filesize

                        1.2MB

                        MD5

                        15a42d3e4579da615a384c717ab2109b

                        SHA1

                        22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                        SHA256

                        3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                        SHA512

                        1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                        Filesize

                        109KB

                        MD5

                        154c3f1334dd435f562672f2664fea6b

                        SHA1

                        51dd25e2ba98b8546de163b8f26e2972a90c2c79

                        SHA256

                        5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                        SHA512

                        1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                        Filesize

                        1.2MB

                        MD5

                        f35b671fda2603ec30ace10946f11a90

                        SHA1

                        059ad6b06559d4db581b1879e709f32f80850872

                        SHA256

                        83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                        SHA512

                        b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                        Filesize

                        384KB

                        MD5

                        afe8bf3481929d5a371ae1a3c15aaa62

                        SHA1

                        27f2c1d1cf93f010e17c959293ec335fa40ceb1b

                        SHA256

                        d253c60dc0f41e4a409a406ecca30757f1312b6c8e34930a0f174e4078a57f76

                        SHA512

                        6efda8b6c425309143238736aee76ff59b23f75c8b262ecd313b629f572b28f1161e835258b69c554642f4442d15180c4747ea2a23b2196e954718503a69bf20

                      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                        Filesize

                        320KB

                        MD5

                        c10dad55de7888d278ad5dc0e212d0e3

                        SHA1

                        21bbfe499707c29ea7d4c7139b6866524098c360

                        SHA256

                        f97c9de83a03ca73c86ffd734bc9a4f4f313ae4db27d5f1e3a4a27dde3280a7f

                        SHA512

                        36471b208ee49c60d20f4cb9da47bb29b78189dce2aad0222e4159ada01b47a379cb5e9496bb72544529185857ae3a6d8901dc6679d70dc5f4d6c6c6e1e01f00

                      • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                        Filesize

                        541KB

                        MD5

                        1fc4b9014855e9238a361046cfbf6d66

                        SHA1

                        c17f18c8246026c9979ab595392a14fe65cc5e9f

                        SHA256

                        f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                        SHA512

                        2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                      • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                        Filesize

                        304KB

                        MD5

                        cc90e3326d7b20a33f8037b9aab238e4

                        SHA1

                        236d173a6ac462d85de4e866439634db3b9eeba3

                        SHA256

                        bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                        SHA512

                        b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                      • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                        Filesize

                        2KB

                        MD5

                        1bbd3f6827bac4b829bb6809b3ce6aab

                        SHA1

                        823cd112e96bba704b5c03e49bf0892aca3440fe

                        SHA256

                        56fec5a861afc52ed97c66a7cfdbf401f7fca43802f934b0d75293c0af1b7b01

                        SHA512

                        ecf2ef70e4f06953e211c3a56a5d1e78b3733191d2a7716383eded4f425d65aa3ec56e2a193b7fb1891f21319288e2622d6a51e41ee8d9d063440a07a63ee11f

                      • C:\Users\Public\Desktop\Google Chrome.lnk
                        Filesize

                        2KB

                        MD5

                        9e2d2705de158beb677518f27bbbdfea

                        SHA1

                        be0024165b635700a7da3f524462c60d0ee01a01

                        SHA256

                        b964bdc957f40bb29e05ad7b7bd52ef902aba414698706ea1421045d7ce72311

                        SHA512

                        a21f79cdaae763ef6762886efe7d0e03eebd4e792a53eb214f39b19232e5d1264fdf6574256aeba55c7f1d3b22571869d8d720f8e2da0fc165f26df093d94a9d

                      • memory/1176-485-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/1176-406-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/1176-443-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/1176-754-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/1176-672-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/1176-738-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/1540-325-0x0000000000BF0000-0x00000000010A5000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/2056-149-0x00000000009F0000-0x0000000000A42000-memory.dmp
                        Filesize

                        328KB

                      • memory/2056-148-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/2056-170-0x00000000066E0000-0x00000000066FE000-memory.dmp
                        Filesize

                        120KB

                      • memory/2056-167-0x00000000054E0000-0x00000000054F0000-memory.dmp
                        Filesize

                        64KB

                      • memory/2056-168-0x0000000005EC0000-0x0000000005F36000-memory.dmp
                        Filesize

                        472KB

                      • memory/2264-467-0x0000000000970000-0x0000000000E25000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/2304-175-0x0000000000C90000-0x0000000000D1C000-memory.dmp
                        Filesize

                        560KB

                      • memory/2304-179-0x000000001B9E0000-0x000000001B9F0000-memory.dmp
                        Filesize

                        64KB

                      • memory/2304-176-0x00007FF9F73B0000-0x00007FF9F7E72000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/2436-2-0x0000000000A90000-0x0000000000F4A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/2436-7-0x0000000005630000-0x0000000005631000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-4-0x0000000005670000-0x0000000005671000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-0-0x0000000000A90000-0x0000000000F4A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/2436-9-0x00000000056B0000-0x00000000056B1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-3-0x0000000005660000-0x0000000005661000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-10-0x00000000056A0000-0x00000000056A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-6-0x0000000005690000-0x0000000005691000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-8-0x0000000005640000-0x0000000005641000-memory.dmp
                        Filesize

                        4KB

                      • memory/2436-1-0x0000000077C46000-0x0000000077C48000-memory.dmp
                        Filesize

                        8KB

                      • memory/2436-15-0x0000000000A90000-0x0000000000F4A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/2436-5-0x0000000005650000-0x0000000005651000-memory.dmp
                        Filesize

                        4KB

                      • memory/2572-532-0x00000000004A0000-0x0000000000955000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/2708-63-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/2708-56-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/2708-166-0x0000000002B10000-0x0000000004B10000-memory.dmp
                        Filesize

                        32.0MB

                      • memory/2708-55-0x00000000006F0000-0x000000000076A000-memory.dmp
                        Filesize

                        488KB

                      • memory/2708-57-0x0000000005120000-0x0000000005130000-memory.dmp
                        Filesize

                        64KB

                      • memory/2708-65-0x0000000002B10000-0x0000000004B10000-memory.dmp
                        Filesize

                        32.0MB

                      • memory/3208-405-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-23-0x0000000004D20000-0x0000000004D21000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-18-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-753-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-442-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-169-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-483-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-19-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-21-0x0000000004D40000-0x0000000004D41000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-737-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-26-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-27-0x0000000004D90000-0x0000000004D91000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-234-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-22-0x0000000004D80000-0x0000000004D81000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-20-0x0000000004D50000-0x0000000004D51000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-94-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-117-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-25-0x0000000004D60000-0x0000000004D61000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-311-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3208-24-0x0000000004D30000-0x0000000004D31000-memory.dmp
                        Filesize

                        4KB

                      • memory/3208-658-0x0000000000A60000-0x0000000000F1A000-memory.dmp
                        Filesize

                        4.7MB

                      • memory/3936-654-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-285-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-96-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-402-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-95-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-454-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-224-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-729-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-193-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-441-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/3936-752-0x0000000000E90000-0x0000000001233000-memory.dmp
                        Filesize

                        3.6MB

                      • memory/4208-73-0x0000000007E80000-0x0000000007EBC000-memory.dmp
                        Filesize

                        240KB

                      • memory/4208-66-0x0000000005180000-0x0000000005212000-memory.dmp
                        Filesize

                        584KB

                      • memory/4208-71-0x0000000007F50000-0x000000000805A000-memory.dmp
                        Filesize

                        1.0MB

                      • memory/4208-69-0x0000000005230000-0x000000000523A000-memory.dmp
                        Filesize

                        40KB

                      • memory/4208-68-0x0000000005320000-0x0000000005330000-memory.dmp
                        Filesize

                        64KB

                      • memory/4208-72-0x0000000006660000-0x0000000006672000-memory.dmp
                        Filesize

                        72KB

                      • memory/4208-67-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/4208-180-0x00000000089C0000-0x0000000008A10000-memory.dmp
                        Filesize

                        320KB

                      • memory/4208-64-0x0000000005730000-0x0000000005CD6000-memory.dmp
                        Filesize

                        5.6MB

                      • memory/4208-60-0x0000000000400000-0x0000000000450000-memory.dmp
                        Filesize

                        320KB

                      • memory/4208-178-0x00000000060D0000-0x0000000006136000-memory.dmp
                        Filesize

                        408KB

                      • memory/4208-74-0x0000000007ED0000-0x0000000007F1C000-memory.dmp
                        Filesize

                        304KB

                      • memory/4208-177-0x0000000005320000-0x0000000005330000-memory.dmp
                        Filesize

                        64KB

                      • memory/4208-70-0x0000000006680000-0x0000000006C98000-memory.dmp
                        Filesize

                        6.1MB

                      • memory/4208-172-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/4256-118-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/4256-125-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/4256-128-0x0000000002D10000-0x0000000004D10000-memory.dmp
                        Filesize

                        32.0MB

                      • memory/4256-119-0x00000000052A0000-0x00000000052B0000-memory.dmp
                        Filesize

                        64KB

                      • memory/4256-116-0x0000000000710000-0x00000000008CC000-memory.dmp
                        Filesize

                        1.7MB

                      • memory/4288-195-0x0000027398800000-0x0000027398810000-memory.dmp
                        Filesize

                        64KB

                      • memory/4288-196-0x0000027398800000-0x0000027398810000-memory.dmp
                        Filesize

                        64KB

                      • memory/4288-194-0x00007FF9F73B0000-0x00007FF9F7E72000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/5116-129-0x0000000073600000-0x0000000073DB1000-memory.dmp
                        Filesize

                        7.7MB

                      • memory/5116-130-0x0000000005530000-0x0000000005540000-memory.dmp
                        Filesize

                        64KB

                      • memory/5116-122-0x0000000000400000-0x0000000000592000-memory.dmp
                        Filesize

                        1.6MB