Analysis
-
max time kernel
52s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe
Resource
win10v2004-20240226-en
General
-
Target
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe
-
Size
1.8MB
-
MD5
f83d4111bc57bd8b891a321ea251641e
-
SHA1
2da26c58ad6dff8f22a1534a9ca0408cd7209deb
-
SHA256
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3
-
SHA512
01632257096ad08cfe6aeebb4b7a0c446ea818bd14b8abbdbf830a697b35b889e38a994b96122fa3463429554b810d2253826f21b5143323193dff37c6574cc7
-
SSDEEP
49152:b2t4+BKZ9c4wX2DzDcnR1FNAm0SeQVUdx:b2xBKbcAMRv+HSeQ2T
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
redline
Jok123
185.215.113.67:26260
Extracted
redline
LiveTraffic
4.185.137.132:1632
Signatures
-
Detect ZGRat V1 30 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe family_zgrat_v1 behavioral1/memory/1096-70-0x0000000000140000-0x00000000002FC000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe family_zgrat_v1 behavioral1/memory/5608-351-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-364-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-353-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-376-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-366-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-378-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-384-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-401-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-414-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-421-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-389-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-424-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-429-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-433-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-436-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-438-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-442-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-446-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-465-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-468-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-470-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-473-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-478-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-482-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-497-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 behavioral1/memory/5608-509-0x0000000005490000-0x00000000056CB000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline behavioral1/memory/2672-122-0x0000000000B50000-0x0000000000BA2000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe family_redline behavioral1/memory/896-154-0x0000000000F00000-0x0000000000F50000-memory.dmp family_redline behavioral1/memory/1456-173-0x0000000000240000-0x00000000002CC000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe family_redline behavioral1/memory/5164-290-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
random.exe96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exeexplorgu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorgu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exeexplorgu.exerandom.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorgu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorgu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explorgu.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation explorgu.exe -
Executes dropped EXE 3 IoCs
Processes:
explorgu.exerandom.exealex1234.exepid process 4432 explorgu.exe 2236 random.exe 1096 alex1234.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorgu.exerandom.exe96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Wine explorgu.exe Key opened \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Wine random.exe Key opened \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Wine 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exeexplorgu.exepid process 1124 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe 4432 explorgu.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
alex1234.exedescription pid process target process PID 1096 set thread context of 1908 1096 alex1234.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exedescription ioc process File created C:\Windows\Tasks\explorgu.job 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5452 5792 WerFault.exe koooooo.exe 3152 5720 WerFault.exe U8Oklz9mEbUJeP80sXxONRnz.exe 4392 2660 WerFault.exe RegAsm.exe 928 2660 WerFault.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exeexplorgu.exepid process 1124 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe 1124 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe 4432 explorgu.exe 4432 explorgu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exepid process 1124 96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
explorgu.exealex1234.exedescription pid process target process PID 4432 wrote to memory of 2236 4432 explorgu.exe random.exe PID 4432 wrote to memory of 2236 4432 explorgu.exe random.exe PID 4432 wrote to memory of 2236 4432 explorgu.exe random.exe PID 4432 wrote to memory of 1096 4432 explorgu.exe alex1234.exe PID 4432 wrote to memory of 1096 4432 explorgu.exe alex1234.exe PID 4432 wrote to memory of 1096 4432 explorgu.exe alex1234.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe PID 1096 wrote to memory of 1908 1096 alex1234.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe"C:\Users\Admin\AppData\Local\Temp\96e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\904519900954_Desktop.zip' -CompressionLevel Optimal6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\904519900954_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1001063001\Jsholum.exe"C:\Users\Admin\AppData\Local\Temp\1001063001\Jsholum.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001065001\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\1001065001\koooooo.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001067001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1001067001\file300un.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
-
C:\Users\Admin\Pictures\7k0sBeH8PXiOzYsgEPnAr0hA.exe"C:\Users\Admin\Pictures\7k0sBeH8PXiOzYsgEPnAr0hA.exe"4⤵
-
C:\Users\Admin\Pictures\AwhHg5eRtt93vdZOlKYGs8t3.exe"C:\Users\Admin\Pictures\AwhHg5eRtt93vdZOlKYGs8t3.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u1do.0.exe"C:\Users\Admin\AppData\Local\Temp\u1do.0.exe"5⤵
-
C:\Users\Admin\Pictures\jQuPcWSvvVjwIkYp38mt7O5r.exe"C:\Users\Admin\Pictures\jQuPcWSvvVjwIkYp38mt7O5r.exe"4⤵
-
C:\Users\Admin\Pictures\Z5YynEm3whgmPaX1HCPpJqe3.exe"C:\Users\Admin\Pictures\Z5YynEm3whgmPaX1HCPpJqe3.exe"4⤵
-
C:\Users\Admin\Pictures\U8Oklz9mEbUJeP80sXxONRnz.exe"C:\Users\Admin\Pictures\U8Oklz9mEbUJeP80sXxONRnz.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6326⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6446⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 8525⤵
- Program crash
-
C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exe"C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exeC:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6bf8e1d0,0x6bf8e1dc,0x6bf8e1e85⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\PMtE5bjIMo2UCrK39xOptZRa.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\PMtE5bjIMo2UCrK39xOptZRa.exe" --version5⤵
-
C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exe"C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5844 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240330083428" --session-guid=92361474-419d-4e53-9f7f-4406139ad6ee --server-tracking-blob=NTMzYTMwOTdkMTU3ZmZiYjgwOTU1Y2JmNzUxZjJhZjdiMDU3MWMyMjIxNzg2MjNmOGJmMTVhMTc3OTM2Mzc0OTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE3ODc2MjAuNTgwNyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImQwMjA2ODA1LWYyNzMtNGY5YS05N2E0LTljZWE4MDJiYmVmMiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=08050000000000005⤵
-
C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exeC:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2a4,0x2a8,0x2ac,0x274,0x2b0,0x6b60e1d0,0x6b60e1dc,0x6b60e1e86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5792 -ip 57921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5720 -ip 57201⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2660 -ip 26601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2660 -ip 26601⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fe3aab3ae544a134b68e881b82b70169
SHA1926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA256bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
SHA5123fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD50bcdda713f998c3a83ec9a882a5b4f99
SHA117481397006eee6abf312941f614d80286256a42
SHA256b95cc317c3b0492b59c90e2ece963cc980c633d2043cfd4ac387719a20b7b5c1
SHA5122eb9bb39a9011100a6f0ef7611d423ed353abd26de47d1d35748bf9bcbe2f8f0782ac3ffce89390652db02eea488d5ea3347704bf33dbe6b28191471eebcffb8
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeFilesize
1.8MB
MD5f83d4111bc57bd8b891a321ea251641e
SHA12da26c58ad6dff8f22a1534a9ca0408cd7209deb
SHA25696e7a02799075bbf3a589b93fbdd04a570cb1319764065f91d066a10a69f3fd3
SHA51201632257096ad08cfe6aeebb4b7a0c446ea818bd14b8abbdbf830a697b35b889e38a994b96122fa3463429554b810d2253826f21b5143323193dff37c6574cc7
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exeFilesize
3.0MB
MD551520dd11591bfde7c6117196bd1c8c5
SHA17a5942e223cc42a1ea4b341d317d2c482c47e181
SHA2568ce2199ce6faaf735689f74c5ecf7c2fbb14ee67c926ffc5ec00001b6b643c35
SHA5124467fc659c7576ff2e5e5ddc0c263ef5931300abd104fcd8b86635938a672a2bb45dba5f36246e79b0a38036eac4d027878b7d30e3efb8097c9eb4ae6ee115f8
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exeFilesize
1.8MB
MD50a472907022de0d3b2460ae9b22e32e5
SHA15b84bdb3b1ffcb4448c9f03fabc3b5f6d6a2c60c
SHA25613e5d440ca2c27e4b83569c68b0d30140be4fe3f7ba8544fdff60fde594572bc
SHA512d8c5008c9d63d09635d500054986b64e71f83f4aa77550a1d702ae5f0c96d78062d2c4e89035c47279f5d64af9bf1237c44f0c5baa1573eaa8af38121745a8c1
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exeFilesize
301KB
MD5832eb4dc3ed8ceb9a1735bd0c7acaf1b
SHA1b622a406927fbb8f6cd5081bd4455fb831948fca
SHA2562a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
SHA5123ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exeFilesize
499KB
MD583d0b41c7a3a0d29a268b49a313c5de5
SHA146f3251c771b67b40b1f3268caef8046174909a5
SHA25609cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
SHA512705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5
-
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exeFilesize
464KB
MD5c084d6f6ba40534fbfc5a64b21ef99ab
SHA10b4a17da83c0a8abbc8fab321931d5447b32b720
SHA256afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
SHA512a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1001063001\Jsholum.exeFilesize
2.4MB
MD593e590ddbf788288603f6e3732b08ab9
SHA16b6d66ecff1ca546f3a63d038cacf21d84ae5577
SHA25601eee1eccb32c1a97ca03c8d5dde19c6ad6fa6a840d55ba9c88baa5aa57891d1
SHA512a699c2514c75433170c2b3d85b7130500c2efc9123e01f4b749f6c599d7ae341573dd3326558f23a362586e0b7915f1072cb84378c1ddf968e87083aa0b45f81
-
C:\Users\Admin\AppData\Local\Temp\1001065001\koooooo.exeFilesize
379KB
MD590f41880d631e243cec086557cb74d63
SHA1cb385e4172cc227ba72baf29ca1c4411fa99a26d
SHA25623b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
SHA512eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3
-
C:\Users\Admin\AppData\Local\Temp\1001067001\file300un.exeFilesize
386KB
MD516f67f1a6e10f044bc15abe8c71b3bd6
SHA1ce0101205b919899a2a2f577100377c2a6546171
SHA25641cca3fa0f500dc6c17d1f02fc906d2b0c769210af9c4286760b84ecf46cab89
SHA512a11db01bf55e3497644918c7dcc6180e0911261f39f062e653f000e1365dc9668fe5bd1d0fee0ae5c740a6477bcea510ba8c5ff6831c3bdb0d7c0590d2487e3c
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403300834270535844.dllFilesize
4.6MB
MD5117176ddeaf70e57d1747704942549e4
SHA175e3ab6b3469d93cce9ea2f7e22b71b987ccdf2b
SHA2563c5b34de987116a4d3240e319c0da89a951c96b81e6705476a0fea27b22b20af
SHA512ca2a356929c92d314aab63d7f3b246d72783212dfa3a4507f28d41a51ca0eedc78e85b1cd453aa8e02c12509f847a0216bb702154f903291c804c8a98ec378b9
-
C:\Users\Admin\AppData\Local\Temp\Tmp4BAA.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f3jqmm3s.33r.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp95F4.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp989A.tmpFilesize
56KB
MD5d444c807029c83b8a892ac0c4971f955
SHA1fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA2568297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e
-
C:\Users\Admin\AppData\Local\Temp\tmp98FA.tmpFilesize
220KB
MD5ef05c812b4d6282622836f65ecadb1c5
SHA18010af35b24cb2a2652a941210e28d7c54aeb852
SHA25654ccc1f52f78532b4b3f3b2c6f5c89ceef96b1b810c1eabe13fbffe9d57ee0a9
SHA512fca4e3c1c3a64946cc0e46b5c896a075a1123f3db89d118fefd4231a018990ac5fbc618070ca9df1cfb12cb05e121868d8fc933a1cc3ae454bdd4d20f71d9759
-
C:\Users\Admin\AppData\Local\Temp\u1do.0.exeFilesize
260KB
MD59ab31625e3f5aac0c282dc39bb360862
SHA183c2b70f0080cc0482c0f1befce3f76809d12a19
SHA256642b8dbf561021aeac022db5d0a527c8799fff4c933c70b6e52a6c62350938d3
SHA5122337b89983e02cb9896e81f1c501d4799129649057627b6817f91f14ff4037ea65ae49b3ace9ab5ae4f4d4f82af3f218c68823646c532f7757ae06fa1ad86900
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
109KB
MD52afdbe3b99a4736083066a13e4b5d11a
SHA14d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA2568d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
1.2MB
MD592fbdfccf6a63acef2743631d16652a7
SHA1971968b1378dd89d59d7f84bf92f16fc68664506
SHA256b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
SHA512b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1904519900-954640453-4250331663-1000\76b53b3ec448f7ccdda2063b15d2bfc3_5baa2aac-6f09-498d-a5a6-e1e70cf8ebe4Filesize
2KB
MD56748783b4609a6d9e97a7c08789a0ae5
SHA1414dac66d7607b019011ee0a68f50c08dd5e686f
SHA256bdf2027cf738b39580df36233648917041b627f6aed7a0d135870add2ff7101f
SHA51234ba0656fa417782f87c562b32157e059fef0a23bb50c64261f175a213a7402a65e8714b11d4958070fcb9204d7bc8e8b74ce45a2fa093548048fe503f03f9cf
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
109KB
MD5726cd06231883a159ec1ce28dd538699
SHA1404897e6a133d255ad5a9c26ac6414d7134285a2
SHA25612fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA5129ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
1.2MB
MD515a42d3e4579da615a384c717ab2109b
SHA122aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA2563c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA5121eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD59d777f6706b49524788159441bbec43f
SHA1c2aa67e489bf027f2b007c32cee747351bdd051c
SHA2565c23216c1ba9d5a599413d2ed7f7d00e2bd86c4c78144b0a11393e80176c7e75
SHA512ec216f2266378a69bedb35093048c196ba50e141c33ce0eb11a14e9f215516e90510b5ba05a07c1ff88f804dae4cf846e0478019ccf96115cc22ad11b5be9185
-
C:\Users\Admin\Pictures\3QBDsESWbsEEv4D3C2pAr1Gk.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\5b0RuHu70uYPss7TZNTLlMxK.exeFilesize
3KB
MD589eeabaf20b5de2ea17b227f0f9528fd
SHA17a20cfef025d6951ef6b6ff77391c5c39a1357d2
SHA2569307ecaa39ba82fc8640604da0cae5dfa8e60f6f9d96b8ffefc515ab5301b885
SHA5120bff0a60a4244081b74858afa7c34de135a271fb24723ee396fcfe4022d9d4de7090918a2d4ff39c50f05ef6e9979bf8691efc2109cb3b153d7ec5c4238b5df9
-
C:\Users\Admin\Pictures\6QeXTHkO6rAhpvFh5XH5iq53.exeFilesize
3KB
MD51f9e82529ee87177d14f3a685cd07c5f
SHA18b90d34d9aaec65ab77bab2a0289b5be5153c78b
SHA25672d3a1b66261116bea28b1ae8e00c8b1f8049866183592cf86600bc3533f31c2
SHA512ed64ecac42db68eda2cb6dcc9633a4aff9366c42db87c5dc794ce7672ced7cf2886bbf0b7ec08f8c3546b7815951599075cbf73ee289bbfc199325d3ee447f14
-
C:\Users\Admin\Pictures\7k0sBeH8PXiOzYsgEPnAr0hA.exeFilesize
4.1MB
MD51e960ea9e4aad581b410dda6aa2a04aa
SHA1e0911d1b57b30db477b571ada17ace88894c8912
SHA25664ec0ab3a8313a2501149bf0f13ed127417b9e45c23527af465ffdacbea6b4ca
SHA512736061321fe84820d8e049b1f541e170af2bbfd9d84861eccccf7c7368e8ddc6a4bef5840b2245e0e128f1d7ef9dc5e827429f720579244578167123bf734c5b
-
C:\Users\Admin\Pictures\AwhHg5eRtt93vdZOlKYGs8t3.exeFilesize
404KB
MD526a10211573e58a96d8c75e533370769
SHA1ed7612ab5012ea02cc0f146eb0bdd171e99fb3ba
SHA2569af5abc5343353001232e546760401de95bd6fb49be4649af9f6d5fdba10658c
SHA512fc348276afea714b132aa99c78d749a9f3fa03651e19b3674f9edc6b0e80807bd211652b1a9d720cc11faa8a4726136a32bfbbe8b1bb07bd66002681e25a7133
-
C:\Users\Admin\Pictures\PMtE5bjIMo2UCrK39xOptZRa.exeFilesize
5.1MB
MD5f8722b5782dd9aed7740a1819dc102f9
SHA1e63800577cc375cb593a04780d8de6d0e87b457b
SHA2566e871f645a07c6c62b9433717c99c7841db701b078045e44fb51ad6222e5570e
SHA5128d62428654fdc3c42a88c5c31d0470c909e8214794a808678e089bdb83dbc5a8ec1f02e6aede363ace98885b9246e3114c83f04be374102c773161ffbb5a5e57
-
C:\Users\Admin\Pictures\U8Oklz9mEbUJeP80sXxONRnz.exeFilesize
437KB
MD57960d8afbbac06f216cceeb1531093bb
SHA1008221bf66a0749447cffcb86f2d1ec80e23fc76
SHA256f6e476e8ccb571b9d7a76234953ad428e883ff4712b0062498ba3275d9749b84
SHA51235d12e81eb892aeb2237049beca61a81469dea5b1c9b7a0b9f49fbf95a95c756509d9e76c732fb10b504f9f9692e1fbe83ea2fd09d791f793a928c01974b8147
-
C:\Users\Admin\Pictures\jQuPcWSvvVjwIkYp38mt7O5r.exeFilesize
4.1MB
MD53d29906b8de0f7f56b59eb04025a68ac
SHA1d49e16f11090d48cc425733668b963ed45b06a60
SHA256ff54a030708d953c4dc1ae0ba31c3f689ab0fe82fe303fa8af7123dd6ae550ff
SHA512102990633c2dad1f6a6684a53caeb946219a68b9ef7255f91d3ac463d1d7c993ce0d4bca83744f440aa0a25834dcc1c1eb4d5bba8e9bf190743fc31d0c270bb3
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD502b4625cb1582d5ee531e8c003e4e01d
SHA1b3a31e94e72dbfc7a367bec86e04bc57f67bac11
SHA256abe6ef112b1e2e1eae7189cd3dcc54b1b856ea601911d1b47b56bdd037035a60
SHA512fd31ff6fb5b6065100b74376266188d418781c388b4c4989850ec6afed737c35cb7fc1d28bd951fedf83e9ecc0d9ba5047638887fa602a6518a68ea1a934f6e3
-
memory/896-214-0x0000000005B90000-0x0000000005BDC000-memory.dmpFilesize
304KB
-
memory/896-188-0x0000000006960000-0x0000000006F78000-memory.dmpFilesize
6.1MB
-
memory/896-213-0x0000000005B00000-0x0000000005B10000-memory.dmpFilesize
64KB
-
memory/896-190-0x0000000005A80000-0x0000000005A92000-memory.dmpFilesize
72KB
-
memory/896-203-0x0000000005B50000-0x0000000005B8C000-memory.dmpFilesize
240KB
-
memory/896-189-0x0000000005C20000-0x0000000005D2A000-memory.dmpFilesize
1.0MB
-
memory/896-174-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/896-154-0x0000000000F00000-0x0000000000F50000-memory.dmpFilesize
320KB
-
memory/1096-81-0x0000000002680000-0x0000000004680000-memory.dmpFilesize
32.0MB
-
memory/1096-70-0x0000000000140000-0x00000000002FC000-memory.dmpFilesize
1.7MB
-
memory/1096-80-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/1096-72-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/1096-71-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/1124-9-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/1124-16-0x0000000000980000-0x0000000000E48000-memory.dmpFilesize
4.8MB
-
memory/1124-7-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/1124-6-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/1124-4-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/1124-5-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/1124-3-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/1124-2-0x0000000000980000-0x0000000000E48000-memory.dmpFilesize
4.8MB
-
memory/1124-1-0x0000000077EB4000-0x0000000077EB6000-memory.dmpFilesize
8KB
-
memory/1124-0-0x0000000000980000-0x0000000000E48000-memory.dmpFilesize
4.8MB
-
memory/1124-8-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1124-10-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/1124-11-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/1456-173-0x0000000000240000-0x00000000002CC000-memory.dmpFilesize
560KB
-
memory/1456-201-0x00007FFFB7DB0000-0x00007FFFB8871000-memory.dmpFilesize
10.8MB
-
memory/1456-216-0x000000001B1C0000-0x000000001B1D0000-memory.dmpFilesize
64KB
-
memory/1908-75-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/1908-84-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/1908-83-0x0000000001410000-0x0000000001420000-memory.dmpFilesize
64KB
-
memory/2228-391-0x0000000000620000-0x0000000000ACB000-memory.dmpFilesize
4.7MB
-
memory/2236-388-0x0000000000D50000-0x000000000110E000-memory.dmpFilesize
3.7MB
-
memory/2236-155-0x0000000000D50000-0x000000000110E000-memory.dmpFilesize
3.7MB
-
memory/2236-49-0x0000000000D50000-0x000000000110E000-memory.dmpFilesize
3.7MB
-
memory/2236-50-0x0000000000D50000-0x000000000110E000-memory.dmpFilesize
3.7MB
-
memory/2236-231-0x0000000000D50000-0x000000000110E000-memory.dmpFilesize
3.7MB
-
memory/2420-109-0x0000000000A80000-0x0000000000F2B000-memory.dmpFilesize
4.7MB
-
memory/2420-137-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/2420-127-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/2420-153-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/2420-175-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/2420-138-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/2420-139-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/2420-148-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/2420-229-0x0000000000A80000-0x0000000000F2B000-memory.dmpFilesize
4.7MB
-
memory/2420-205-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/2420-152-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/2420-126-0x0000000000A80000-0x0000000000F2B000-memory.dmpFilesize
4.7MB
-
memory/2672-123-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/2672-217-0x00000000068B0000-0x00000000068CE000-memory.dmpFilesize
120KB
-
memory/2672-122-0x0000000000B50000-0x0000000000BA2000-memory.dmpFilesize
328KB
-
memory/2672-157-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/2672-125-0x00000000054A0000-0x0000000005532000-memory.dmpFilesize
584KB
-
memory/2672-149-0x0000000005490000-0x000000000549A000-memory.dmpFilesize
40KB
-
memory/2672-124-0x0000000005970000-0x0000000005F14000-memory.dmpFilesize
5.6MB
-
memory/2672-187-0x00000000060A0000-0x0000000006116000-memory.dmpFilesize
472KB
-
memory/4336-434-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4336-428-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4432-101-0x0000000000130000-0x00000000005F8000-memory.dmpFilesize
4.8MB
-
memory/4432-28-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/4432-479-0x0000000000130000-0x00000000005F8000-memory.dmpFilesize
4.8MB
-
memory/4432-29-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/4432-27-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/4432-295-0x0000000000130000-0x00000000005F8000-memory.dmpFilesize
4.8MB
-
memory/4432-82-0x0000000000130000-0x00000000005F8000-memory.dmpFilesize
4.8MB
-
memory/4432-23-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/4432-19-0x0000000000130000-0x00000000005F8000-memory.dmpFilesize
4.8MB
-
memory/4432-20-0x0000000000130000-0x00000000005F8000-memory.dmpFilesize
4.8MB
-
memory/4432-21-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/4432-22-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/4432-24-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4432-26-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/4432-25-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/5164-290-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/5608-378-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-473-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-470-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-478-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-468-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-465-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-482-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-497-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-446-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-509-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-442-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-438-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-436-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-433-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-429-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-424-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-389-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-421-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-414-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-401-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-384-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-366-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-376-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-353-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-364-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB
-
memory/5608-351-0x0000000005490000-0x00000000056CB000-memory.dmpFilesize
2.2MB