Analysis

  • max time kernel
    66s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-03-2024 12:02

General

  • Target

    5c02baf7cc1a89b9248b0e80103e1ceafa4f2307adcb233e8b18151c6804ca71.exe

  • Size

    1.8MB

  • MD5

    8cef71906c123049c0e3a0ebd9f420e3

  • SHA1

    60f4c13bc04c536f56b6fcb82fca6ebd556084d6

  • SHA256

    5c02baf7cc1a89b9248b0e80103e1ceafa4f2307adcb233e8b18151c6804ca71

  • SHA512

    6561c864d6c684e394160bcec82c36a12a8dc87070f224eae28d08ec92ceff29dedf84cc9307d7f1ccc035ffe4339fb67285e0756b72426658d70710031eacff

  • SSDEEP

    49152:VN3o9vO1DXwG/lKa1y2In8b51LGFgxzcy9mVc3jG2A:VBo9vk7saHb51LGFgxwWmAC2

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c02baf7cc1a89b9248b0e80103e1ceafa4f2307adcb233e8b18151c6804ca71.exe
    "C:\Users\Admin\AppData\Local\Temp\5c02baf7cc1a89b9248b0e80103e1ceafa4f2307adcb233e8b18151c6804ca71.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Users\Admin\AppData\Local\Temp\1000042001\8d3bf4fb3f.exe
        "C:\Users\Admin\AppData\Local\Temp\1000042001\8d3bf4fb3f.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:3152
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:4484
      • C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
        "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3076
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b93946f8,0x7ff8b9394708,0x7ff8b9394718
            5⤵
              PID:3748
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
              5⤵
                PID:5064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2716
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
                5⤵
                  PID:4572
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                  5⤵
                    PID:1416
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                    5⤵
                      PID:1856
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
                      5⤵
                        PID:5332
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
                        5⤵
                          PID:5556
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                          5⤵
                            PID:5864
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
                            5⤵
                              PID:6040
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                              5⤵
                                PID:2468
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
                                5⤵
                                  PID:5596
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
                                  5⤵
                                    PID:5608
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5328
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
                                    5⤵
                                      PID:5788
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11597890656412693344,12723515643760395449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                                      5⤵
                                        PID:5796
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
                                      4⤵
                                        PID:4864
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b93946f8,0x7ff8b9394708,0x7ff8b9394718
                                          5⤵
                                            PID:4460
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1440,6472677649166302999,8829356477561301467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
                                            5⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5172
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4504
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8b93946f8,0x7ff8b9394708,0x7ff8b9394718
                                            5⤵
                                              PID:636
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16805724978269496555,4572318665840652242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
                                              5⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5576
                                        • C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
                                          3⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Drops file in Windows directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5408
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                          3⤵
                                          • Loads dropped DLL
                                          PID:6024
                                          • C:\Windows\system32\rundll32.exe
                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                            4⤵
                                            • Blocklisted process makes network request
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4496
                                            • C:\Windows\system32\netsh.exe
                                              netsh wlan show profiles
                                              5⤵
                                                PID:5268
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\134859772495_Desktop.zip' -CompressionLevel Optimal
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5752
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Loads dropped DLL
                                            PID:4936
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:5184
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:5876
                                          • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                            C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Adds Run key to start application
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5884
                                            • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
                                              2⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              PID:1652
                                            • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:3244
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                3⤵
                                                • Checks computer location settings
                                                PID:744
                                                • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                  "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:6056
                                                • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                  "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Modifies system certificate store
                                                  PID:6060
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                                                  4⤵
                                                    PID:5600
                                                    • C:\Windows\SysWOW64\choice.exe
                                                      choice /C Y /N /D Y /T 3
                                                      5⤵
                                                        PID:5960
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                                  2⤵
                                                  • Loads dropped DLL
                                                  PID:928
                                                  • C:\Windows\system32\rundll32.exe
                                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                                    3⤵
                                                    • Loads dropped DLL
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5296
                                                    • C:\Windows\system32\netsh.exe
                                                      netsh wlan show profiles
                                                      4⤵
                                                        PID:6076
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\134859772495_Desktop.zip' -CompressionLevel Optimal
                                                        4⤵
                                                          PID:1488
                                                    • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
                                                      2⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2252
                                                    • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:4540
                                                    • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
                                                      2⤵
                                                        PID:6064
                                                      • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe"
                                                        2⤵
                                                          PID:3420
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe" /F
                                                            3⤵
                                                            • Creates scheduled task(s)
                                                            PID:1288
                                                        • C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe"
                                                          2⤵
                                                            PID:4988
                                                          • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
                                                            2⤵
                                                              PID:2056
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                3⤵
                                                                  PID:4976
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                                                2⤵
                                                                  PID:1204
                                                                • C:\Users\Admin\AppData\Local\Temp\1001055001\file300un.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1001055001\file300un.exe"
                                                                  2⤵
                                                                    PID:1968
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                                                      3⤵
                                                                        PID:4584
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                        3⤵
                                                                          PID:1240
                                                                          • C:\Users\Admin\Pictures\dWBvBwmTRm9ZgeQNt2TmrUE0.exe
                                                                            "C:\Users\Admin\Pictures\dWBvBwmTRm9ZgeQNt2TmrUE0.exe"
                                                                            4⤵
                                                                              PID:1568
                                                                              • C:\Users\Admin\AppData\Local\Temp\u17k.0.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\u17k.0.exe"
                                                                                5⤵
                                                                                  PID:2236
                                                                                • C:\Users\Admin\AppData\Local\Temp\u17k.1.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\u17k.1.exe"
                                                                                  5⤵
                                                                                    PID:5448
                                                                                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                                                                      6⤵
                                                                                        PID:3048
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1444
                                                                                      5⤵
                                                                                      • Program crash
                                                                                      PID:4628
                                                                                  • C:\Users\Admin\Pictures\HCO2PRsPkFQ0NgdQ26PRiFfk.exe
                                                                                    "C:\Users\Admin\Pictures\HCO2PRsPkFQ0NgdQ26PRiFfk.exe"
                                                                                    4⤵
                                                                                      PID:3572
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -nologo -noprofile
                                                                                        5⤵
                                                                                          PID:3840
                                                                                      • C:\Users\Admin\Pictures\u9FbQazZCGbhOPEWw7NysUNU.exe
                                                                                        "C:\Users\Admin\Pictures\u9FbQazZCGbhOPEWw7NysUNU.exe"
                                                                                        4⤵
                                                                                          PID:6104
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -nologo -noprofile
                                                                                            5⤵
                                                                                              PID:5572
                                                                                          • C:\Users\Admin\Pictures\MGAPfR4lrm4NgDJ4VS7TTIZQ.exe
                                                                                            "C:\Users\Admin\Pictures\MGAPfR4lrm4NgDJ4VS7TTIZQ.exe"
                                                                                            4⤵
                                                                                              PID:4844
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                5⤵
                                                                                                  PID:5580
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 648
                                                                                                    6⤵
                                                                                                    • Program crash
                                                                                                    PID:5656
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 668
                                                                                                    6⤵
                                                                                                    • Program crash
                                                                                                    PID:1184
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 852
                                                                                                  5⤵
                                                                                                  • Program crash
                                                                                                  PID:6092
                                                                                              • C:\Users\Admin\Pictures\XdejNUnSWCCGlUoslTtOUNpi.exe
                                                                                                "C:\Users\Admin\Pictures\XdejNUnSWCCGlUoslTtOUNpi.exe"
                                                                                                4⤵
                                                                                                  PID:5232
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -nologo -noprofile
                                                                                                    5⤵
                                                                                                      PID:5968
                                                                                                  • C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe
                                                                                                    "C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe" --silent --allusers=0
                                                                                                    4⤵
                                                                                                      PID:1968
                                                                                                      • C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe
                                                                                                        C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6b54e1d0,0x6b54e1dc,0x6b54e1e8
                                                                                                        5⤵
                                                                                                          PID:4464
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eXIo32VRSUhp0Y3EPrFjmaEN.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eXIo32VRSUhp0Y3EPrFjmaEN.exe" --version
                                                                                                          5⤵
                                                                                                            PID:5680
                                                                                                          • C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe
                                                                                                            "C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1968 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240329120440" --session-guid=4fc1f868-dbef-4c2d-802c-604818e4e0ed --server-tracking-blob=OGFhNjk3MDk2OGMyZGViZGM5YjQyYzAyOWNjYmZmNGU5YjgyOGQzMzdiMzAyYzZlNWI5ZDA1N2Q3ZTY5ZTVhMDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE3MTM4NzMuMjgyNSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjRiMjI0OWE5LTI2NzQtNGFkNC1iNjBkLTI3ZmQyODY2YzUwNiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC04000000000000
                                                                                                            5⤵
                                                                                                              PID:3156
                                                                                                              • C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe
                                                                                                                C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2b4,0x2b8,0x2bc,0x284,0x2c0,0x6a8ee1d0,0x6a8ee1dc,0x6a8ee1e8
                                                                                                                6⤵
                                                                                                                  PID:2660
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                                                                                                5⤵
                                                                                                                  PID:4440
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\assistant\assistant_installer.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\assistant\assistant_installer.exe" --version
                                                                                                                  5⤵
                                                                                                                    PID:552
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\assistant\assistant_installer.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x3d0040,0x3d004c,0x3d0058
                                                                                                                      6⤵
                                                                                                                        PID:1464
                                                                                                                  • C:\Users\Admin\Pictures\bK9TTH2qJlwHcdz6WyToQqiT.exe
                                                                                                                    "C:\Users\Admin\Pictures\bK9TTH2qJlwHcdz6WyToQqiT.exe"
                                                                                                                    4⤵
                                                                                                                      PID:5476
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                                                                    3⤵
                                                                                                                      PID:452
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                  1⤵
                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                  • Checks BIOS information in registry
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Identifies Wine through registry keys
                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:5452
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4844 -ip 4844
                                                                                                                  1⤵
                                                                                                                    PID:6032
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1568 -ip 1568
                                                                                                                    1⤵
                                                                                                                      PID:468
                                                                                                                    • C:\Windows\SysWOW64\dialer.exe
                                                                                                                      "C:\Windows\system32\dialer.exe"
                                                                                                                      1⤵
                                                                                                                        PID:4812
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5580 -ip 5580
                                                                                                                        1⤵
                                                                                                                          PID:3664
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5580 -ip 5580
                                                                                                                          1⤵
                                                                                                                            PID:4888
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                            1⤵
                                                                                                                              PID:6036
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                              1⤵
                                                                                                                                PID:5660
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                1⤵
                                                                                                                                  PID:5580
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:5756

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                  Execution

                                                                                                                                  Scheduled Task/Job

                                                                                                                                  1
                                                                                                                                  T1053

                                                                                                                                  Persistence

                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                  1
                                                                                                                                  T1547

                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                  1
                                                                                                                                  T1547.001

                                                                                                                                  Scheduled Task/Job

                                                                                                                                  1
                                                                                                                                  T1053

                                                                                                                                  Privilege Escalation

                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                  1
                                                                                                                                  T1547

                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                  1
                                                                                                                                  T1547.001

                                                                                                                                  Scheduled Task/Job

                                                                                                                                  1
                                                                                                                                  T1053

                                                                                                                                  Defense Evasion

                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                  2
                                                                                                                                  T1497

                                                                                                                                  Modify Registry

                                                                                                                                  2
                                                                                                                                  T1112

                                                                                                                                  Subvert Trust Controls

                                                                                                                                  1
                                                                                                                                  T1553

                                                                                                                                  Install Root Certificate

                                                                                                                                  1
                                                                                                                                  T1553.004

                                                                                                                                  Credential Access

                                                                                                                                  Unsecured Credentials

                                                                                                                                  3
                                                                                                                                  T1552

                                                                                                                                  Credentials In Files

                                                                                                                                  2
                                                                                                                                  T1552.001

                                                                                                                                  Credentials in Registry

                                                                                                                                  1
                                                                                                                                  T1552.002

                                                                                                                                  Discovery

                                                                                                                                  Query Registry

                                                                                                                                  5
                                                                                                                                  T1012

                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                  2
                                                                                                                                  T1497

                                                                                                                                  System Information Discovery

                                                                                                                                  4
                                                                                                                                  T1082

                                                                                                                                  Collection

                                                                                                                                  Data from Local System

                                                                                                                                  3
                                                                                                                                  T1005

                                                                                                                                  Command and Control

                                                                                                                                  Web Service

                                                                                                                                  1
                                                                                                                                  T1102

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\ProgramData\mozglue.dll
                                                                                                                                    Filesize

                                                                                                                                    593KB

                                                                                                                                    MD5

                                                                                                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                    SHA1

                                                                                                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                    SHA256

                                                                                                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                    SHA512

                                                                                                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                  • C:\Users\Admin\AppData\Local\9YP0OZtxe49udlLQMGyFujVJ.exe
                                                                                                                                    Filesize

                                                                                                                                    4.1MB

                                                                                                                                    MD5

                                                                                                                                    98273a3121a2516cda6f31e67ec2d52f

                                                                                                                                    SHA1

                                                                                                                                    01c6990adecce2b1e4794429f478fc3f63baaf83

                                                                                                                                    SHA256

                                                                                                                                    1c65e140170310153ba3929cdedecf221ae57e55c79b97fa1a4601f4d97ee988

                                                                                                                                    SHA512

                                                                                                                                    c633c87af70740d7d147a62ea91cd7fe8764b816fe7b2a076955d6a35474dd745a2c5d05f39efd32b204e59845914d2e4d571d2440f78bbc6d2ab71491343118

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    fe3aab3ae544a134b68e881b82b70169

                                                                                                                                    SHA1

                                                                                                                                    926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                                                                                                    SHA256

                                                                                                                                    bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                                                                                                    SHA512

                                                                                                                                    3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    Filesize

                                                                                                                                    152B

                                                                                                                                    MD5

                                                                                                                                    7c6136bc98a5aedca2ea3004e9fbe67d

                                                                                                                                    SHA1

                                                                                                                                    74318d997f4c9c351eef86d040bc9b085ce1ad4f

                                                                                                                                    SHA256

                                                                                                                                    50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

                                                                                                                                    SHA512

                                                                                                                                    2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    Filesize

                                                                                                                                    152B

                                                                                                                                    MD5

                                                                                                                                    5c6aef82e50d05ffc0cf52a6c6d69c91

                                                                                                                                    SHA1

                                                                                                                                    c203efe5b45b0630fee7bd364fe7d63b769e2351

                                                                                                                                    SHA256

                                                                                                                                    d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

                                                                                                                                    SHA512

                                                                                                                                    77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    984B

                                                                                                                                    MD5

                                                                                                                                    caadcc327bc76fe2e39532e319b93880

                                                                                                                                    SHA1

                                                                                                                                    a229ad60948c430d7ad2eae82e57d9239c147974

                                                                                                                                    SHA256

                                                                                                                                    8b77a9eedae8155a00aee46a4069cb82b2bd39b0ab7cf19bfceba64ca8c86eac

                                                                                                                                    SHA512

                                                                                                                                    592bba68890503e30730d6cb297985e4ee479d1578dd0eea97bb733633947da79bf533685de88eed9396284dbb29fa62d3b1ad46444ec5c360f38f1b22bd01f1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
                                                                                                                                    Filesize

                                                                                                                                    20KB

                                                                                                                                    MD5

                                                                                                                                    011104582436434f5a076eae510f010a

                                                                                                                                    SHA1

                                                                                                                                    7874b0f4d18c76906b0a6497c62b3b79cf969c09

                                                                                                                                    SHA256

                                                                                                                                    591549e538ecf662dba41aa254e68bea2f1979cec52386cc9a4db6f556c4db17

                                                                                                                                    SHA512

                                                                                                                                    35f7f6affcc3a0ce533e3ffa2f7ec8c655245db1bb3ee602a496f79d3590ba29ea23d52f3e3eba5dc031a9f6ee22185b5a580d967cfcabb4d1e8a811ad4c0906

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    2942cb98feb0ed69ec43236dc6bce32a

                                                                                                                                    SHA1

                                                                                                                                    e5f1b932335827a64938984713b109e37efe13a9

                                                                                                                                    SHA256

                                                                                                                                    a036fb21a73b7f0ff74b378f4b80f5f3f2dde6b83c50d7182ad04ac93e1d73ae

                                                                                                                                    SHA512

                                                                                                                                    d5e7e2bf9e42c34a7c6cfe93868b381d32c833d0d7be7618e5dc4724ee3cc5eeb3e56d7b9cf14d649a49d225ac04067bcb3dceb9cd6491a75a8dc8e158a819d6

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    32a43d52cd39b5663504aacb566b2045

                                                                                                                                    SHA1

                                                                                                                                    b96b35555c7d193c97b3564d06d151082886104e

                                                                                                                                    SHA256

                                                                                                                                    e4b690fd5b57890e83fdda0c40bf21220129b0bc0ee18225de2a3503d4773890

                                                                                                                                    SHA512

                                                                                                                                    a4929b7c39ce2b2587a84ece6c5f403273c8c2674a51866facefd0443fc6efd61fd2b94e36ab16be13088c1ec0c8768f127a56aac42b910373a4e63d8c8ea374

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    ce2e2e764f7af3da488d6e65e95bec7e

                                                                                                                                    SHA1

                                                                                                                                    ac27007ddf051dbb68bc7a9b07c55deb69adeba6

                                                                                                                                    SHA256

                                                                                                                                    9f274278f7d792d8b12b431dec44a78ca0bc69963c6ea5526d0cb34df6654553

                                                                                                                                    SHA512

                                                                                                                                    e1c8dea5611da7e6fa42fbeb087c122531aee2268c516d0c74b4a621c7578190ec5d55e3adbaa04e451a64e64f354f100b1e2edcd33e37d5c7dc642d0f4d8896

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                    Filesize

                                                                                                                                    707B

                                                                                                                                    MD5

                                                                                                                                    b7a4884e0c4e03e1185a767c1db96a8b

                                                                                                                                    SHA1

                                                                                                                                    686aeada001b5d43773499dddfa67729e1da29e1

                                                                                                                                    SHA256

                                                                                                                                    d1090d01f9b65e23fe0394cb41c4d88c8d5b92af985dcf5c4385dc178f0fe57a

                                                                                                                                    SHA512

                                                                                                                                    fd662742641a05c093be5760436ee742b1164e7c73eaf303e45a80841bff6530ff7772c165e40b0734ac31337f662b720457dc7dc8ec947ac2da41d349f8c5e6

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                    Filesize

                                                                                                                                    707B

                                                                                                                                    MD5

                                                                                                                                    bbf60a52b48f2f790f871f14a857654f

                                                                                                                                    SHA1

                                                                                                                                    f9872ca843e3ed633d33abc385ea534a93e9956e

                                                                                                                                    SHA256

                                                                                                                                    038ccc6bdb7d2946cc92681a5d4b1f2fa6569671626b9381179739b5e295a8dc

                                                                                                                                    SHA512

                                                                                                                                    ad90764c3b5e0fdd4b49be085db13a6d0d793e7b642221ab20c06d589ee6aec1a11e98d1755499abe0b01bf487adda3e4c56979a8a8c336a173b0a3eeb26a003

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f78f.TMP
                                                                                                                                    Filesize

                                                                                                                                    707B

                                                                                                                                    MD5

                                                                                                                                    65b327d87c51d1367ff6c722d78368e4

                                                                                                                                    SHA1

                                                                                                                                    e884e861ee98f1b408acafdcf8c1472ad2fc5838

                                                                                                                                    SHA256

                                                                                                                                    c2f93c77e22c8b002fc26101295ef54e787af49bed7ddc2d434c3994198b351b

                                                                                                                                    SHA512

                                                                                                                                    5ef39673e2ad9da015934948996a578120f7db7178b6ca054a14720e4864225287df76cace6fe2447140b782430418040aa3cab50a6f8832274975c70cd7987c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                    Filesize

                                                                                                                                    16B

                                                                                                                                    MD5

                                                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                                                    SHA1

                                                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                    SHA256

                                                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                    SHA512

                                                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    11KB

                                                                                                                                    MD5

                                                                                                                                    50d47af360c53f0eb3abd34124e9b6b2

                                                                                                                                    SHA1

                                                                                                                                    78c1986af709903161d0087efafadb5c9fa53184

                                                                                                                                    SHA256

                                                                                                                                    dce38b5a0bc16d5fa0c76598550d3ef9d91c298890d0a88f5d07f7a7ba2255f7

                                                                                                                                    SHA512

                                                                                                                                    592585b4e2ea3d0c2c32a9e1b4e4eedad5caae97097c90248fcbbaec3e9754bcb5c75223b3cb9619daff9facc39b0c4c3404163b2aa1692a57982d248aac9a1b

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    11KB

                                                                                                                                    MD5

                                                                                                                                    0f76ea941064db73cae0f43777da332e

                                                                                                                                    SHA1

                                                                                                                                    e7e532dd8564799b24241065cb163ddcc95ac059

                                                                                                                                    SHA256

                                                                                                                                    2defb341bb7a59f3585e98187961ef08fdf5e816e961ef1d695212b16905c4c2

                                                                                                                                    SHA512

                                                                                                                                    c3b63f03c26f137d65c707fecb9263e48648b4e4918de4affbd408b3ed4de7e460f88d983f69e0abec4b0b88b22cd8c6724e959216db72c5967e193ec345ec87

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    MD5

                                                                                                                                    9ee642b4bfb508f1fe07a81864b49ebc

                                                                                                                                    SHA1

                                                                                                                                    6544d01c8b1faf63422cb2150eb3952a1537052b

                                                                                                                                    SHA256

                                                                                                                                    14b0a28d3175a242768625592b10b9fb1536a2f847d4ccd26794053bbbad6fc9

                                                                                                                                    SHA512

                                                                                                                                    172c15207094b24b49c0d80c2a7e3a43ac2c91c22763898262ccf3f70aaa2eeadd66e2fcbe39106c3a607198bfac1fac681c8f738a756b2f7ef6d45807facbb7

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    11KB

                                                                                                                                    MD5

                                                                                                                                    e65a2d3ee3430b0d5a32753ef2469f40

                                                                                                                                    SHA1

                                                                                                                                    1543d77304979fec82912933a88695d87da494d7

                                                                                                                                    SHA256

                                                                                                                                    c2e1514c1dbbc551e414540a1a18b7367ba1b7b14fd3bd445aef4e754f353a6a

                                                                                                                                    SHA512

                                                                                                                                    d9fc30ebbf66f21084ba3547a1389a0380ec74cb7b4a36bf723ee19e59afc90827369abed2d9460b8bb16b80541e3d16de92aa7008b693ebc4207d425eab8c7d

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                    Filesize

                                                                                                                                    1KB

                                                                                                                                    MD5

                                                                                                                                    4b6a25a6c2228d5e8c6d21de29f7ab9b

                                                                                                                                    SHA1

                                                                                                                                    08b46ff30e31bb8b32ed835458f40885d5f3f305

                                                                                                                                    SHA256

                                                                                                                                    a2ac48e136a9d05230a7710bf2a0777dc5537066ba16a4dd0cc5f904040677e7

                                                                                                                                    SHA512

                                                                                                                                    c67ac96967fcd644d2c6c27de99bda74e05adf169a10b0126af3558f71ec019882df92a554e9fdd368eed797a3c27b2afb409a681e9c35ae879ad93ee08cad7a

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\additional_file0.tmp
                                                                                                                                    Filesize

                                                                                                                                    2.5MB

                                                                                                                                    MD5

                                                                                                                                    20d293b9bf23403179ca48086ba88867

                                                                                                                                    SHA1

                                                                                                                                    dedf311108f607a387d486d812514a2defbd1b9e

                                                                                                                                    SHA256

                                                                                                                                    fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

                                                                                                                                    SHA512

                                                                                                                                    5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403291204401\opera_package
                                                                                                                                    Filesize

                                                                                                                                    34.8MB

                                                                                                                                    MD5

                                                                                                                                    5665a7a6149d83fa3990b0bfcafdf90f

                                                                                                                                    SHA1

                                                                                                                                    14fbf350ceb7f7debe7743faa0baaa5521efae50

                                                                                                                                    SHA256

                                                                                                                                    46b20184dcc42ba8671ab9af22810c3fb6825e390273b3cbe405ffc5e1a07be2

                                                                                                                                    SHA512

                                                                                                                                    de4980f697e06f800e3ddac36ad5528183b5ee2f2793f189e02138572edeffd262a0749b2b629bea9c526841d9c9a2e2e5e3dee40626382d684aebf52c42df11

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                    Filesize

                                                                                                                                    1.8MB

                                                                                                                                    MD5

                                                                                                                                    8cef71906c123049c0e3a0ebd9f420e3

                                                                                                                                    SHA1

                                                                                                                                    60f4c13bc04c536f56b6fcb82fca6ebd556084d6

                                                                                                                                    SHA256

                                                                                                                                    5c02baf7cc1a89b9248b0e80103e1ceafa4f2307adcb233e8b18151c6804ca71

                                                                                                                                    SHA512

                                                                                                                                    6561c864d6c684e394160bcec82c36a12a8dc87070f224eae28d08ec92ceff29dedf84cc9307d7f1ccc035ffe4339fb67285e0756b72426658d70710031eacff

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000042001\8d3bf4fb3f.exe
                                                                                                                                    Filesize

                                                                                                                                    3.1MB

                                                                                                                                    MD5

                                                                                                                                    346ddba47f6fabef752b2d9633cf5ca3

                                                                                                                                    SHA1

                                                                                                                                    b338ea2be5012a72e0681c097feae15c785dafd0

                                                                                                                                    SHA256

                                                                                                                                    bfdb396a094d7457e243379fd31c3de59a4f00c315f7e8fb6263f7babd12f906

                                                                                                                                    SHA512

                                                                                                                                    fb51a1223aa77ddb989cfd4195bde63f5ac1d8a3959f68301fa2ab66cd6552f63735a8d165d0944f5a7cc5b024e96ad5af7b162481ea81ea0105f6e84cf3f7a8

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
                                                                                                                                    Filesize

                                                                                                                                    894KB

                                                                                                                                    MD5

                                                                                                                                    2f8912af892c160c1c24c9f38a60c1ab

                                                                                                                                    SHA1

                                                                                                                                    d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

                                                                                                                                    SHA256

                                                                                                                                    59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

                                                                                                                                    SHA512

                                                                                                                                    0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
                                                                                                                                    Filesize

                                                                                                                                    1.8MB

                                                                                                                                    MD5

                                                                                                                                    70cc66ea2a3de44e1e0b7e6d6954569a

                                                                                                                                    SHA1

                                                                                                                                    4468a51f760ff319172c111cce7b54d1ff93efa9

                                                                                                                                    SHA256

                                                                                                                                    d85047b22c62c35cfac371778dd92db8ac907be315160f34cfb03f00830e703f

                                                                                                                                    SHA512

                                                                                                                                    1a0f646d3387fb3b35792b9c1d72c33333968b3c3142543c90093f3400739e6bc73d62914807abf26ddd3b4410fe1c7cfd58cb925bd5e74aac8384959f342937

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                                                                                                                    Filesize

                                                                                                                                    1.7MB

                                                                                                                                    MD5

                                                                                                                                    85a15f080b09acace350ab30460c8996

                                                                                                                                    SHA1

                                                                                                                                    3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                                                                                                    SHA256

                                                                                                                                    3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                                                                                                    SHA512

                                                                                                                                    ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                                                                                                    Filesize

                                                                                                                                    301KB

                                                                                                                                    MD5

                                                                                                                                    832eb4dc3ed8ceb9a1735bd0c7acaf1b

                                                                                                                                    SHA1

                                                                                                                                    b622a406927fbb8f6cd5081bd4455fb831948fca

                                                                                                                                    SHA256

                                                                                                                                    2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

                                                                                                                                    SHA512

                                                                                                                                    3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                                                                                                    Filesize

                                                                                                                                    499KB

                                                                                                                                    MD5

                                                                                                                                    83d0b41c7a3a0d29a268b49a313c5de5

                                                                                                                                    SHA1

                                                                                                                                    46f3251c771b67b40b1f3268caef8046174909a5

                                                                                                                                    SHA256

                                                                                                                                    09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

                                                                                                                                    SHA512

                                                                                                                                    705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                                    Filesize

                                                                                                                                    418KB

                                                                                                                                    MD5

                                                                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                    SHA1

                                                                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                    SHA256

                                                                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                    SHA512

                                                                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe
                                                                                                                                    Filesize

                                                                                                                                    2.8MB

                                                                                                                                    MD5

                                                                                                                                    1e1152424d7721a51a154a725fe2465e

                                                                                                                                    SHA1

                                                                                                                                    62bc3d11e915e1dbd3cc3ef5a11afec755c995d9

                                                                                                                                    SHA256

                                                                                                                                    674cf1a8997ec6ac5b29b8d7eb6a5fb63ce5aaf4b19ff1ec7749b0225c49906c

                                                                                                                                    SHA512

                                                                                                                                    752e7912d30a2f006ef79600b7412db61644630471ec44bab1e5b2565ef62ccb490ea69159420bb7626248cc8113fe07c09fa51f5c630646b179d880e18b7c02

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                                                                                                    Filesize

                                                                                                                                    464KB

                                                                                                                                    MD5

                                                                                                                                    c084d6f6ba40534fbfc5a64b21ef99ab

                                                                                                                                    SHA1

                                                                                                                                    0b4a17da83c0a8abbc8fab321931d5447b32b720

                                                                                                                                    SHA256

                                                                                                                                    afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

                                                                                                                                    SHA512

                                                                                                                                    a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001055001\file300un.exe
                                                                                                                                    Filesize

                                                                                                                                    386KB

                                                                                                                                    MD5

                                                                                                                                    16f67f1a6e10f044bc15abe8c71b3bd6

                                                                                                                                    SHA1

                                                                                                                                    ce0101205b919899a2a2f577100377c2a6546171

                                                                                                                                    SHA256

                                                                                                                                    41cca3fa0f500dc6c17d1f02fc906d2b0c769210af9c4286760b84ecf46cab89

                                                                                                                                    SHA512

                                                                                                                                    a11db01bf55e3497644918c7dcc6180e0911261f39f062e653f000e1365dc9668fe5bd1d0fee0ae5c740a6477bcea510ba8c5ff6831c3bdb0d7c0590d2487e3c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403291204400155680.dll
                                                                                                                                    Filesize

                                                                                                                                    4.6MB

                                                                                                                                    MD5

                                                                                                                                    117176ddeaf70e57d1747704942549e4

                                                                                                                                    SHA1

                                                                                                                                    75e3ab6b3469d93cce9ea2f7e22b71b987ccdf2b

                                                                                                                                    SHA256

                                                                                                                                    3c5b34de987116a4d3240e319c0da89a951c96b81e6705476a0fea27b22b20af

                                                                                                                                    SHA512

                                                                                                                                    ca2a356929c92d314aab63d7f3b246d72783212dfa3a4507f28d41a51ca0eedc78e85b1cd453aa8e02c12509f847a0216bb702154f903291c804c8a98ec378b9

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Tmp4929.tmp
                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                    SHA1

                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                    SHA256

                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                    SHA512

                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_btcmh1gd.ui5.ps1
                                                                                                                                    Filesize

                                                                                                                                    60B

                                                                                                                                    MD5

                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                    SHA1

                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                    SHA256

                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                    SHA512

                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    b9cfe1b665fd0f71b81947f9385863e6

                                                                                                                                    SHA1

                                                                                                                                    cb4bcc6a73f500a87a4c80e578c809587af0c522

                                                                                                                                    SHA256

                                                                                                                                    5512fe266bd13f0972b2ac26e474da710051ace530bd24432dcedeecd898bbbb

                                                                                                                                    SHA512

                                                                                                                                    d5f5e22f5d08b034967a0b1f75abe402215e5387006a697534d577858dad3e784003d9adee597ee00fe4541f8841c07fe549a04312753872ced2d1a1d106c6b2

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    dc733b1258f7bebafb5410701c758931

                                                                                                                                    SHA1

                                                                                                                                    e53ebc45917fbc08e425eb1e9807e2a9385f1fb0

                                                                                                                                    SHA256

                                                                                                                                    ed4892bff3ec8c5e1cba88edf8e800f7a812013d2a04642b59e1775f18a8cf2b

                                                                                                                                    SHA512

                                                                                                                                    348fb198f191c962d78c0d71ca5b20ca8b69bca50dc485f0efa81a02f5660d9ff7f16eebe7ab11f42e69d87e6f9a5593db017b0ba480aaa88859c22622445edf

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp71C2.tmp
                                                                                                                                    Filesize

                                                                                                                                    46KB

                                                                                                                                    MD5

                                                                                                                                    02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                    SHA1

                                                                                                                                    84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                    SHA256

                                                                                                                                    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                    SHA512

                                                                                                                                    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp7291.tmp
                                                                                                                                    Filesize

                                                                                                                                    48KB

                                                                                                                                    MD5

                                                                                                                                    349e6eb110e34a08924d92f6b334801d

                                                                                                                                    SHA1

                                                                                                                                    bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                    SHA256

                                                                                                                                    c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                    SHA512

                                                                                                                                    2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp72C3.tmp
                                                                                                                                    Filesize

                                                                                                                                    116KB

                                                                                                                                    MD5

                                                                                                                                    f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                    SHA1

                                                                                                                                    50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                    SHA256

                                                                                                                                    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                    SHA512

                                                                                                                                    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u17k.0.exe
                                                                                                                                    Filesize

                                                                                                                                    233KB

                                                                                                                                    MD5

                                                                                                                                    87188a05666ced303bb17f04ec29042f

                                                                                                                                    SHA1

                                                                                                                                    651ae4e7b98655fd4dd2de62b0111dacac47cd9e

                                                                                                                                    SHA256

                                                                                                                                    97332596f72bc538f176fddac06e1c2ba40922ee87329d8be32d7ac80127de97

                                                                                                                                    SHA512

                                                                                                                                    14301c8b8641e5e19203abfcc17755ccefe2b551c3e6ff235b21ccb17e4ee977a060ed7ee7268c446d86191f271bddcb8a59d22e61e1cf9ff7a46d0ee09dbb99

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u17k.1.exe
                                                                                                                                    Filesize

                                                                                                                                    4.6MB

                                                                                                                                    MD5

                                                                                                                                    397926927bca55be4a77839b1c44de6e

                                                                                                                                    SHA1

                                                                                                                                    e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                    SHA256

                                                                                                                                    4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                    SHA512

                                                                                                                                    cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                                                                                                    Filesize

                                                                                                                                    109KB

                                                                                                                                    MD5

                                                                                                                                    2afdbe3b99a4736083066a13e4b5d11a

                                                                                                                                    SHA1

                                                                                                                                    4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                                                                                                                    SHA256

                                                                                                                                    8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                                                                                                                    SHA512

                                                                                                                                    d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                                                                                                    Filesize

                                                                                                                                    1.2MB

                                                                                                                                    MD5

                                                                                                                                    92fbdfccf6a63acef2743631d16652a7

                                                                                                                                    SHA1

                                                                                                                                    971968b1378dd89d59d7f84bf92f16fc68664506

                                                                                                                                    SHA256

                                                                                                                                    b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                                                                                                                    SHA512

                                                                                                                                    b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                                                                    Filesize

                                                                                                                                    109KB

                                                                                                                                    MD5

                                                                                                                                    726cd06231883a159ec1ce28dd538699

                                                                                                                                    SHA1

                                                                                                                                    404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                                                                    SHA256

                                                                                                                                    12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                                                                    SHA512

                                                                                                                                    9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                                                                    Filesize

                                                                                                                                    1.2MB

                                                                                                                                    MD5

                                                                                                                                    15a42d3e4579da615a384c717ab2109b

                                                                                                                                    SHA1

                                                                                                                                    22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                                                                    SHA256

                                                                                                                                    3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                                                                    SHA512

                                                                                                                                    1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                                                                                                    Filesize

                                                                                                                                    541KB

                                                                                                                                    MD5

                                                                                                                                    1fc4b9014855e9238a361046cfbf6d66

                                                                                                                                    SHA1

                                                                                                                                    c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                                                                                                    SHA256

                                                                                                                                    f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                                                                                                    SHA512

                                                                                                                                    2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                                                                                                    Filesize

                                                                                                                                    304KB

                                                                                                                                    MD5

                                                                                                                                    cc90e3326d7b20a33f8037b9aab238e4

                                                                                                                                    SHA1

                                                                                                                                    236d173a6ac462d85de4e866439634db3b9eeba3

                                                                                                                                    SHA256

                                                                                                                                    bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                                                                                                    SHA512

                                                                                                                                    b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                                                                                                  • C:\Users\Admin\Pictures\MGAPfR4lrm4NgDJ4VS7TTIZQ.exe
                                                                                                                                    Filesize

                                                                                                                                    437KB

                                                                                                                                    MD5

                                                                                                                                    7960d8afbbac06f216cceeb1531093bb

                                                                                                                                    SHA1

                                                                                                                                    008221bf66a0749447cffcb86f2d1ec80e23fc76

                                                                                                                                    SHA256

                                                                                                                                    f6e476e8ccb571b9d7a76234953ad428e883ff4712b0062498ba3275d9749b84

                                                                                                                                    SHA512

                                                                                                                                    35d12e81eb892aeb2237049beca61a81469dea5b1c9b7a0b9f49fbf95a95c756509d9e76c732fb10b504f9f9692e1fbe83ea2fd09d791f793a928c01974b8147

                                                                                                                                  • C:\Users\Admin\Pictures\Ob7LVKuJzve3QMh7UyQ2ulEE.exe
                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    5b423612b36cde7f2745455c5dd82577

                                                                                                                                    SHA1

                                                                                                                                    0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                    SHA256

                                                                                                                                    e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                    SHA512

                                                                                                                                    c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                  • C:\Users\Admin\Pictures\QsVIm1ykYw6tcPUBpJMtZUmr.exe
                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    97eabf8d34c74368bd8318eb587100af

                                                                                                                                    SHA1

                                                                                                                                    a092bb69599eb898a4625f93cfa888787fc4ed88

                                                                                                                                    SHA256

                                                                                                                                    5cd32e0b1b5429e83a09ab7d6f6d8b378c4dbe3ec9774523bb6354fa62b100a7

                                                                                                                                    SHA512

                                                                                                                                    a4759805283c08cccd616c4f533bf67fed864239e6060f601fc6b9d106a993e10d5ba397319454d5892c4d34e9856699769382395643fe89575222367c2322bc

                                                                                                                                  • C:\Users\Admin\Pictures\bK9TTH2qJlwHcdz6WyToQqiT.exe
                                                                                                                                    Filesize

                                                                                                                                    4.3MB

                                                                                                                                    MD5

                                                                                                                                    858bb0a3b4fa6a54586402e3ee117076

                                                                                                                                    SHA1

                                                                                                                                    997c31f043347883ea5ed2323a558b6cc5ea9c8e

                                                                                                                                    SHA256

                                                                                                                                    d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35

                                                                                                                                    SHA512

                                                                                                                                    e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

                                                                                                                                  • C:\Users\Admin\Pictures\dWBvBwmTRm9ZgeQNt2TmrUE0.exe
                                                                                                                                    Filesize

                                                                                                                                    378KB

                                                                                                                                    MD5

                                                                                                                                    a05eb8eeeb2ec539e4f54ac435ba86bc

                                                                                                                                    SHA1

                                                                                                                                    72ed93362d4c17434981cf5fd0e3888c44587dfb

                                                                                                                                    SHA256

                                                                                                                                    e57e37490a710106cb78deba4b189fc867b994d4ade9f040dc5486665f549708

                                                                                                                                    SHA512

                                                                                                                                    69456e5c0f237820642c8790746866979db14c40099287b6b3409b305a314cafccbe2a443812824096cd5a9dac9a1e6710a8154479cb050a6aa17d3054143201

                                                                                                                                  • C:\Users\Admin\Pictures\eXIo32VRSUhp0Y3EPrFjmaEN.exe
                                                                                                                                    Filesize

                                                                                                                                    5.1MB

                                                                                                                                    MD5

                                                                                                                                    1699bed6ce65a5cdf0bdd13f8bda5eea

                                                                                                                                    SHA1

                                                                                                                                    d850a5052a50627e866cc5804b4e667ebd45d11c

                                                                                                                                    SHA256

                                                                                                                                    d6f95dc5497f820882ad6bc4667202d9b6d83e7086f70feaad137db921fe4fa8

                                                                                                                                    SHA512

                                                                                                                                    c7973eaf3feb08f5b4650d209ebef379d15dc057dffcfeeb296e4b5b4ac698128878495994df9c4a0703922582fd44659609b8d0e07a2a2c3fa8dc3a0f56e0e0

                                                                                                                                  • C:\Users\Admin\Pictures\nvXybaDMWSJ6ZxwmjlszRMNc.exe
                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    8af5e641db960af56d7703111adfd158

                                                                                                                                    SHA1

                                                                                                                                    95ff33db38f6b4ea85b7079d074ebb3487e306a3

                                                                                                                                    SHA256

                                                                                                                                    98f8414500344a14423222267583335b85de486277c10af1cb34f5929ad99725

                                                                                                                                    SHA512

                                                                                                                                    305013c60fac56c61901a3972d5e3af46a6c786c2893b08a4a0cd9cb9fe12b23f08265dd2d3509532a26738a05a6b5556872fc8a3f695bbbabf6a9ec6215bc44

                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    3c3d26c73493270ca5a0d508fcf46e38

                                                                                                                                    SHA1

                                                                                                                                    36dbcda94bed3cb3c76d4b1af1adc7bf9afb5ff4

                                                                                                                                    SHA256

                                                                                                                                    41fb7b62cd614dd22a2f4660b71a33324f7c06d75512b2953f3c14f3b7bf0b9c

                                                                                                                                    SHA512

                                                                                                                                    60dfe8ea51ca82a53dc6308a6a83e9b51498f7de91919d4d8fa3eddd37f598b164b9b0e2732ef3ae08efdd607a7372f07dd6473a08eccfe37c72d3ab13bbd0a1

                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                    Filesize

                                                                                                                                    127B

                                                                                                                                    MD5

                                                                                                                                    8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                    SHA1

                                                                                                                                    a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                    SHA256

                                                                                                                                    9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                    SHA512

                                                                                                                                    5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                  • \??\pipe\LOCAL\crashpad_3076_CBNPYMXGYBIGOYWO
                                                                                                                                    MD5

                                                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                    SHA1

                                                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                    SHA256

                                                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                    SHA512

                                                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                  • memory/744-487-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    1.6MB

                                                                                                                                  • memory/864-5-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-2-0x00000000008D0000-0x0000000000D90000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/864-3-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-4-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-21-0x00000000008D0000-0x0000000000D90000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/864-10-0x0000000004C10000-0x0000000004C11000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-6-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-7-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-8-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-9-0x0000000004C20000-0x0000000004C21000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/864-0-0x00000000008D0000-0x0000000000D90000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/864-1-0x0000000077434000-0x0000000077436000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                  • memory/1652-585-0x0000000000820000-0x0000000000BEC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/2252-617-0x0000000000AC0000-0x0000000000F80000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/3152-173-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-350-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-349-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-524-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-776-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-399-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-53-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-51-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/3152-412-0x0000000000320000-0x00000000006EC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4456-26-0x0000000005740000-0x0000000005741000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-401-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-31-0x0000000005790000-0x0000000005791000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-459-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-27-0x0000000005720000-0x0000000005721000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-32-0x0000000005780000-0x0000000005781000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-28-0x0000000005760000-0x0000000005761000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-24-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-29-0x0000000005700000-0x0000000005701000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-192-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-30-0x0000000005710000-0x0000000005711000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-25-0x0000000005730000-0x0000000005731000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4456-140-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-582-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-23-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4456-379-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/4484-99-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-100-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-54-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-398-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-57-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-400-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-58-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-59-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-60-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-70-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-71-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-72-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-75-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-81-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-82-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-83-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-85-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-61-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-95-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-96-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-98-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-105-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-97-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-119-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-131-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-130-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-102-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-141-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-103-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-129-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-128-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-120-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-104-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-106-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4484-113-0x0000000000400000-0x00000000007CC000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    3.8MB

                                                                                                                                  • memory/4988-796-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/4988-797-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/4988-799-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/4988-804-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/4988-815-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/4988-819-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/4988-827-0x0000000004F80000-0x0000000005196000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                  • memory/5408-174-0x0000000000550000-0x00000000009FF000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.7MB

                                                                                                                                  • memory/5408-194-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-172-0x0000000000550000-0x00000000009FF000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.7MB

                                                                                                                                  • memory/5408-175-0x0000000004D60000-0x0000000004D61000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-176-0x0000000004D70000-0x0000000004D71000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-177-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-178-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-215-0x0000000000550000-0x00000000009FF000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.7MB

                                                                                                                                  • memory/5408-180-0x0000000004D30000-0x0000000004D31000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-184-0x0000000004D90000-0x0000000004D91000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-181-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5408-195-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-422-0x0000000005100000-0x0000000005101000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-418-0x0000000005130000-0x0000000005131000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-415-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/5452-417-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/5452-419-0x0000000005140000-0x0000000005141000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-421-0x0000000005170000-0x0000000005171000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-420-0x0000000005120000-0x0000000005121000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-423-0x0000000005110000-0x0000000005111000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5452-434-0x0000000000F40000-0x0000000001400000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.8MB

                                                                                                                                  • memory/5452-424-0x0000000005160000-0x0000000005161000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5752-242-0x000001E2E8880000-0x000001E2E88A2000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                  • memory/5752-280-0x000001E2E8B70000-0x000001E2E8B7A000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    40KB

                                                                                                                                  • memory/5752-279-0x000001E2E8B80000-0x000001E2E8B92000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    72KB

                                                                                                                                  • memory/5752-248-0x00007FF8B5380000-0x00007FF8B5E41000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/5752-251-0x000001E2E8910000-0x000001E2E8920000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/5752-250-0x000001E2E8910000-0x000001E2E8920000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/5752-289-0x00007FF8B5380000-0x00007FF8B5E41000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    10.8MB

                                                                                                                                  • memory/5752-249-0x000001E2E8910000-0x000001E2E8920000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                  • memory/5884-437-0x0000000004F80000-0x0000000004F81000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5884-777-0x0000000000790000-0x0000000000C3F000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.7MB

                                                                                                                                  • memory/5884-427-0x0000000004F40000-0x0000000004F41000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5884-416-0x0000000000790000-0x0000000000C3F000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.7MB

                                                                                                                                  • memory/5884-551-0x0000000000790000-0x0000000000C3F000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4.7MB

                                                                                                                                  • memory/5884-436-0x0000000004F30000-0x0000000004F31000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5884-432-0x0000000004F90000-0x0000000004F91000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5884-435-0x0000000004F20000-0x0000000004F21000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5884-426-0x0000000004F60000-0x0000000004F61000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5884-425-0x0000000004F50000-0x0000000004F51000-memory.dmp
                                                                                                                                    Filesize

                                                                                                                                    4KB