Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    68s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 00:36

General

  • Target

    22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe

  • Size

    1.8MB

  • MD5

    d22ac552bde50aec908a505ab37377b6

  • SHA1

    c5f7d3f19293ffa045aec238704e0417bafd5261

  • SHA256

    22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d

  • SHA512

    1d8467c41fbe7126b4a8b8472219b173dcecde20427fed7c34df1ad9f9fb064b67fe913b0f3c06ab2e2363720d3e8a53d3cedf7df7424ad4be6ae317d1bb8cca

  • SSDEEP

    49152:HPMWECeSMTZQli5qxC01Z/qX/AubYCm/Faszje:HtECe7ZPqY0youbFm/Ms

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

Jok123

C2

185.215.113.67:26260

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.137.132:1632

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 6 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 9 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
    "C:\Users\Admin\AppData\Local\Temp\22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:1020
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
      "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:4132
          • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
            4⤵
              PID:4108
            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
              4⤵
                PID:3528
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                4⤵
                  PID:6836
                  • C:\Windows\SysWOW64\choice.exe
                    choice /C Y /N /D Y /T 3
                    5⤵
                      PID:7116
              • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
                2⤵
                • Executes dropped EXE
                PID:4372
              • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
                2⤵
                • Executes dropped EXE
                PID:1184
              • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
                2⤵
                  PID:4160
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                      PID:3640
                  • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
                    2⤵
                      PID:3940
                      • C:\Windows\SysWOW64\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
                        3⤵
                        • Creates scheduled task(s)
                        PID:4616
                    • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                      "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
                      2⤵
                        PID:2572
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                            PID:1928
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 872
                            3⤵
                            • Program crash
                            PID:3428
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                          2⤵
                            PID:216
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                              3⤵
                                PID:4592
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  4⤵
                                    PID:1536
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\045580317372_Desktop.zip' -CompressionLevel Optimal
                                    4⤵
                                      PID:768
                                • C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
                                  2⤵
                                    PID:424
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      3⤵
                                        PID:2708
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 852
                                        3⤵
                                        • Program crash
                                        PID:3232
                                    • C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe"
                                      2⤵
                                        PID:1964
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
                                          3⤵
                                            PID:1432
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc1cb946f8,0x7ffc1cb94708,0x7ffc1cb94718
                                              4⤵
                                                PID:2284
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                                                4⤵
                                                  PID:2384
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                                                  4⤵
                                                    PID:3872
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
                                                    4⤵
                                                      PID:5196
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                                      4⤵
                                                        PID:5360
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                                                        4⤵
                                                          PID:5412
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                                                          4⤵
                                                            PID:6004
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                                                            4⤵
                                                              PID:6016
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                                                              4⤵
                                                                PID:236
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13501810756333051699,2126359205316430880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                                                4⤵
                                                                  PID:3916
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
                                                                3⤵
                                                                  PID:3540
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1cb946f8,0x7ffc1cb94708,0x7ffc1cb94718
                                                                    4⤵
                                                                      PID:3988
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8882816727295465706,6331895455478911692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
                                                                      4⤵
                                                                        PID:5420
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8882816727295465706,6331895455478911692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
                                                                        4⤵
                                                                          PID:5476
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                        3⤵
                                                                          PID:1620
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffc1cb946f8,0x7ffc1cb94708,0x7ffc1cb94718
                                                                            4⤵
                                                                              PID:4988
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1472,8966319911096317984,4318576865833310778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                                                              4⤵
                                                                                PID:5876
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,8966319911096317984,4318576865833310778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                4⤵
                                                                                  PID:5964
                                                                            • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
                                                                              2⤵
                                                                                PID:532
                                                                              • C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
                                                                                2⤵
                                                                                  PID:2844
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                                                                  2⤵
                                                                                    PID:336
                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"
                                                                                    2⤵
                                                                                      PID:4548
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe" -Force
                                                                                        3⤵
                                                                                          PID:1500
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                                          3⤵
                                                                                            PID:5992
                                                                                            • C:\Users\Admin\Pictures\R1NUY22IcAeZWamyrlQGXb2S.exe
                                                                                              "C:\Users\Admin\Pictures\R1NUY22IcAeZWamyrlQGXb2S.exe"
                                                                                              4⤵
                                                                                                PID:5632
                                                                                              • C:\Users\Admin\Pictures\n1QWiOWXphrNLjUQ4daRcKQV.exe
                                                                                                "C:\Users\Admin\Pictures\n1QWiOWXphrNLjUQ4daRcKQV.exe"
                                                                                                4⤵
                                                                                                  PID:6300
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -nologo -noprofile
                                                                                                    5⤵
                                                                                                      PID:1188
                                                                                                    • C:\Users\Admin\Pictures\n1QWiOWXphrNLjUQ4daRcKQV.exe
                                                                                                      "C:\Users\Admin\Pictures\n1QWiOWXphrNLjUQ4daRcKQV.exe"
                                                                                                      5⤵
                                                                                                        PID:4600
                                                                                                    • C:\Users\Admin\Pictures\Ax1P3KaSowEHwEkkgIiniirk.exe
                                                                                                      "C:\Users\Admin\Pictures\Ax1P3KaSowEHwEkkgIiniirk.exe"
                                                                                                      4⤵
                                                                                                        PID:6356
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -nologo -noprofile
                                                                                                          5⤵
                                                                                                            PID:6388
                                                                                                          • C:\Users\Admin\Pictures\Ax1P3KaSowEHwEkkgIiniirk.exe
                                                                                                            "C:\Users\Admin\Pictures\Ax1P3KaSowEHwEkkgIiniirk.exe"
                                                                                                            5⤵
                                                                                                              PID:5564
                                                                                                          • C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe
                                                                                                            "C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe" --silent --allusers=0
                                                                                                            4⤵
                                                                                                              PID:6500
                                                                                                              • C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe
                                                                                                                C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0x6bcce1d0,0x6bcce1dc,0x6bcce1e8
                                                                                                                5⤵
                                                                                                                  PID:6548
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\jHH4Ti0JXR2ffsp4PCZaumZL.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\jHH4Ti0JXR2ffsp4PCZaumZL.exe" --version
                                                                                                                  5⤵
                                                                                                                    PID:6644
                                                                                                                  • C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe
                                                                                                                    "C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6500 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240405003844" --session-guid=7f334379-7942-4c0a-ac94-21fea1b57629 --server-tracking-blob=MWE5ODY1NzEwM2I0NDEzZDYyMGQ3MTY1MDk2ZTE0ODEwYWYwMDA4OWYwMDZiNzNjNmYyNGIyOTE1OWI3OTA5Yjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIyNzc1MTkuNzIzOSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjY1N2U4ZGJhLTAyZmEtNDc0MS1hOWE4LTM4NmQxNTRkMjM2NSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6004000000000000
                                                                                                                    5⤵
                                                                                                                      PID:6728
                                                                                                                      • C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe
                                                                                                                        C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6b1be1d0,0x6b1be1dc,0x6b1be1e8
                                                                                                                        6⤵
                                                                                                                          PID:6824
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                                                                                                        5⤵
                                                                                                                          PID:5940
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\assistant\assistant_installer.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\assistant\assistant_installer.exe" --version
                                                                                                                          5⤵
                                                                                                                            PID:6480
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\assistant\assistant_installer.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xec0040,0xec004c,0xec0058
                                                                                                                              6⤵
                                                                                                                                PID:6516
                                                                                                                          • C:\Users\Admin\Pictures\43ARCqskaY0FbudI7Tw9YZ2h.exe
                                                                                                                            "C:\Users\Admin\Pictures\43ARCqskaY0FbudI7Tw9YZ2h.exe"
                                                                                                                            4⤵
                                                                                                                              PID:6760
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2572 -ip 2572
                                                                                                                        1⤵
                                                                                                                          PID:1564
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 424 -ip 424
                                                                                                                          1⤵
                                                                                                                            PID:3624
                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:5764
                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:3992
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4228
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:5932
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                    1⤵
                                                                                                                                      PID:4352

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                      Filesize

                                                                                                                                      3KB

                                                                                                                                      MD5

                                                                                                                                      fe3aab3ae544a134b68e881b82b70169

                                                                                                                                      SHA1

                                                                                                                                      926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                                                                                                      SHA256

                                                                                                                                      bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                                                                                                      SHA512

                                                                                                                                      3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                      Filesize

                                                                                                                                      152B

                                                                                                                                      MD5

                                                                                                                                      0764f5481d3c05f5d391a36463484b49

                                                                                                                                      SHA1

                                                                                                                                      2c96194f04e768ac9d7134bc242808e4d8aeb149

                                                                                                                                      SHA256

                                                                                                                                      cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

                                                                                                                                      SHA512

                                                                                                                                      a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                      Filesize

                                                                                                                                      152B

                                                                                                                                      MD5

                                                                                                                                      e494d16e4b331d7fc483b3ae3b2e0973

                                                                                                                                      SHA1

                                                                                                                                      d13ca61b6404902b716f7b02f0070dec7f36edbf

                                                                                                                                      SHA256

                                                                                                                                      a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

                                                                                                                                      SHA512

                                                                                                                                      016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                      Filesize

                                                                                                                                      6KB

                                                                                                                                      MD5

                                                                                                                                      f7a878196e1045b08959ea142670d623

                                                                                                                                      SHA1

                                                                                                                                      c38e2708e4e8c344b13b12d0b900ffe229523fe5

                                                                                                                                      SHA256

                                                                                                                                      d95dccb951ade50281d8261c7f99a3dc9be902e00ac80856f917c617effbd4f7

                                                                                                                                      SHA512

                                                                                                                                      791c12af794b0500179d80e22400148f7f8b9084d868eabf15514ae4b3e5e1d51cc69853c5672164472d95fc83c84326da8ab1156fc2083dc0c91d35ed242ce3

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      MD5

                                                                                                                                      7ca883175ff1b04771cb14dd9e7f79ad

                                                                                                                                      SHA1

                                                                                                                                      39bc84134954010cc53e19b56fecca1a680bb71c

                                                                                                                                      SHA256

                                                                                                                                      90091ff29998c109e510c232212a943f9a648a086cee39dd2d60a3d4ae8d54f6

                                                                                                                                      SHA512

                                                                                                                                      1265401c8c41e0d2694f7df142360d50417c6f21108931cda22b9905fd8c4b113adb601bf0bd141ac05294739e96bac68cd8c477e115d893da3bd8d7017b1ef0

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      MD5

                                                                                                                                      ff02d1e8e86040a8ae1f97a7cc3dd5a0

                                                                                                                                      SHA1

                                                                                                                                      0a2ebf6730dbd177ab2f2cc985044f51264669b4

                                                                                                                                      SHA256

                                                                                                                                      15b909a08ce543e16e8a371153328313122aaa9ef741076b46731bd8b3b5d01e

                                                                                                                                      SHA512

                                                                                                                                      553beb4f304b7fb3030b96afa6b3d50ac2307cf7f1472034b7fe50e6921d1329b8f81161603add24e669ed2572b06f770e2e29ac8c345de3614052e506956296

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                      Filesize

                                                                                                                                      1KB

                                                                                                                                      MD5

                                                                                                                                      37f757cff5b1b543dcf175fade0604d9

                                                                                                                                      SHA1

                                                                                                                                      bfad8bbff4f6ae4acac7ca60c7a020860871ab59

                                                                                                                                      SHA256

                                                                                                                                      9e4455e1fab3d4513210dc823717cf7f6f8d3c11e0b045252bf58a0a67e541ff

                                                                                                                                      SHA512

                                                                                                                                      ec018572c9e1da1169e3a872b0e65eb3688e89760d230445908c76c5ddfcd83253c747b69a2b99594b6abdb5089962419774f5adcb73c805d20ff27fd97a6fbb

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\additional_file0.tmp

                                                                                                                                      Filesize

                                                                                                                                      2.5MB

                                                                                                                                      MD5

                                                                                                                                      20d293b9bf23403179ca48086ba88867

                                                                                                                                      SHA1

                                                                                                                                      dedf311108f607a387d486d812514a2defbd1b9e

                                                                                                                                      SHA256

                                                                                                                                      fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

                                                                                                                                      SHA512

                                                                                                                                      5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404050038441\opera_package

                                                                                                                                      Filesize

                                                                                                                                      49.9MB

                                                                                                                                      MD5

                                                                                                                                      5431bcf44506f8a67bd80becc3efecd0

                                                                                                                                      SHA1

                                                                                                                                      4572d71a7b3a27b3fcb62baae96d60d8e552de4a

                                                                                                                                      SHA256

                                                                                                                                      8ce5d000a0d75b4afa183b0e166148881e39b54b03bacbdb7bed646e644ce430

                                                                                                                                      SHA512

                                                                                                                                      9f620562fb86a86d9e39a84c19bd9dca8adb9a9b479c5beafe79e4678ea76a718e1ea0efc362727db62368f9eb72f2b3cc326238acee12fd7c92dfb6fdf0933c

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                      MD5

                                                                                                                                      d22ac552bde50aec908a505ab37377b6

                                                                                                                                      SHA1

                                                                                                                                      c5f7d3f19293ffa045aec238704e0417bafd5261

                                                                                                                                      SHA256

                                                                                                                                      22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d

                                                                                                                                      SHA512

                                                                                                                                      1d8467c41fbe7126b4a8b8472219b173dcecde20427fed7c34df1ad9f9fb064b67fe913b0f3c06ab2e2363720d3e8a53d3cedf7df7424ad4be6ae317d1bb8cca

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                      MD5

                                                                                                                                      85a15f080b09acace350ab30460c8996

                                                                                                                                      SHA1

                                                                                                                                      3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                                                                                                      SHA256

                                                                                                                                      3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                                                                                                      SHA512

                                                                                                                                      ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe

                                                                                                                                      Filesize

                                                                                                                                      301KB

                                                                                                                                      MD5

                                                                                                                                      832eb4dc3ed8ceb9a1735bd0c7acaf1b

                                                                                                                                      SHA1

                                                                                                                                      b622a406927fbb8f6cd5081bd4455fb831948fca

                                                                                                                                      SHA256

                                                                                                                                      2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

                                                                                                                                      SHA512

                                                                                                                                      3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe

                                                                                                                                      Filesize

                                                                                                                                      499KB

                                                                                                                                      MD5

                                                                                                                                      83d0b41c7a3a0d29a268b49a313c5de5

                                                                                                                                      SHA1

                                                                                                                                      46f3251c771b67b40b1f3268caef8046174909a5

                                                                                                                                      SHA256

                                                                                                                                      09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

                                                                                                                                      SHA512

                                                                                                                                      705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe

                                                                                                                                      Filesize

                                                                                                                                      464KB

                                                                                                                                      MD5

                                                                                                                                      c084d6f6ba40534fbfc5a64b21ef99ab

                                                                                                                                      SHA1

                                                                                                                                      0b4a17da83c0a8abbc8fab321931d5447b32b720

                                                                                                                                      SHA256

                                                                                                                                      afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

                                                                                                                                      SHA512

                                                                                                                                      a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe

                                                                                                                                      Filesize

                                                                                                                                      418KB

                                                                                                                                      MD5

                                                                                                                                      0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                      SHA1

                                                                                                                                      0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                      SHA256

                                                                                                                                      919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                      SHA512

                                                                                                                                      5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe

                                                                                                                                      Filesize

                                                                                                                                      321KB

                                                                                                                                      MD5

                                                                                                                                      1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                      SHA1

                                                                                                                                      33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                      SHA256

                                                                                                                                      e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                      SHA512

                                                                                                                                      53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe

                                                                                                                                      Filesize

                                                                                                                                      379KB

                                                                                                                                      MD5

                                                                                                                                      90f41880d631e243cec086557cb74d63

                                                                                                                                      SHA1

                                                                                                                                      cb385e4172cc227ba72baf29ca1c4411fa99a26d

                                                                                                                                      SHA256

                                                                                                                                      23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0

                                                                                                                                      SHA512

                                                                                                                                      eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe

                                                                                                                                      Filesize

                                                                                                                                      894KB

                                                                                                                                      MD5

                                                                                                                                      2f8912af892c160c1c24c9f38a60c1ab

                                                                                                                                      SHA1

                                                                                                                                      d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

                                                                                                                                      SHA256

                                                                                                                                      59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

                                                                                                                                      SHA512

                                                                                                                                      0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe

                                                                                                                                      Filesize

                                                                                                                                      3.0MB

                                                                                                                                      MD5

                                                                                                                                      c75832c14209324e2a4b86c9f43b9a16

                                                                                                                                      SHA1

                                                                                                                                      daae309d8205fb9867ceb2eaa02666d01dd76c71

                                                                                                                                      SHA256

                                                                                                                                      32aff3e6c5fd16ea096efc696578e322d4baf14ed7c900946725b407d8efdbd0

                                                                                                                                      SHA512

                                                                                                                                      71152ebd9e2d59545b53595544bf99d1dde004e358c21bbe840982ff3e2a16bcc0e6e8b57e3a944f30325b7f829f5c86fe413d40a04b7ee9162d799a7723077b

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe

                                                                                                                                      Filesize

                                                                                                                                      400KB

                                                                                                                                      MD5

                                                                                                                                      f64a5b8a765d95f6a3c05ed366cbe802

                                                                                                                                      SHA1

                                                                                                                                      3fe9c9482f3e68f067d0c3c4ae9661a7f9f70f50

                                                                                                                                      SHA256

                                                                                                                                      0a9df33580d2f032589301602ae78df0fd0daa276eb5308695e5978626996ff7

                                                                                                                                      SHA512

                                                                                                                                      2e259ba2c57acf6f4e99f717a25577066e1e7b1af5d5b88d3b3a7f1e4b0dec88391af001c3ab29335767ac0e49cea2748ce2b1633647399e4031deffd7f843e3

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404050038425546500.dll

                                                                                                                                      Filesize

                                                                                                                                      4.6MB

                                                                                                                                      MD5

                                                                                                                                      2a3159d6fef1100348d64bf9c72d15ee

                                                                                                                                      SHA1

                                                                                                                                      52a08f06f6baaa12163b92f3c6509e6f1e003130

                                                                                                                                      SHA256

                                                                                                                                      668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303

                                                                                                                                      SHA512

                                                                                                                                      251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Tmp7D1A.tmp

                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                      SHA1

                                                                                                                                      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                      SHA256

                                                                                                                                      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                      SHA512

                                                                                                                                      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epfuygrc.k0i.ps1

                                                                                                                                      Filesize

                                                                                                                                      60B

                                                                                                                                      MD5

                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                      SHA1

                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                      SHA256

                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                      SHA512

                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpB6E9.tmp

                                                                                                                                      Filesize

                                                                                                                                      46KB

                                                                                                                                      MD5

                                                                                                                                      02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                      SHA1

                                                                                                                                      84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                      SHA256

                                                                                                                                      522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                      SHA512

                                                                                                                                      60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpB8B1.tmp

                                                                                                                                      Filesize

                                                                                                                                      48KB

                                                                                                                                      MD5

                                                                                                                                      349e6eb110e34a08924d92f6b334801d

                                                                                                                                      SHA1

                                                                                                                                      bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                      SHA256

                                                                                                                                      c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                      SHA512

                                                                                                                                      2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpEF1.tmp

                                                                                                                                      Filesize

                                                                                                                                      116KB

                                                                                                                                      MD5

                                                                                                                                      f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                      SHA1

                                                                                                                                      50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                      SHA256

                                                                                                                                      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                      SHA512

                                                                                                                                      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                                                                                                                                      Filesize

                                                                                                                                      109KB

                                                                                                                                      MD5

                                                                                                                                      2afdbe3b99a4736083066a13e4b5d11a

                                                                                                                                      SHA1

                                                                                                                                      4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                                                                                                                      SHA256

                                                                                                                                      8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                                                                                                                      SHA512

                                                                                                                                      d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                                                                                                                                      Filesize

                                                                                                                                      1.2MB

                                                                                                                                      MD5

                                                                                                                                      92fbdfccf6a63acef2743631d16652a7

                                                                                                                                      SHA1

                                                                                                                                      971968b1378dd89d59d7f84bf92f16fc68664506

                                                                                                                                      SHA256

                                                                                                                                      b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                                                                                                                      SHA512

                                                                                                                                      b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3045580317-3728985860-206385570-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2d983147-f9f1-498d-be7e-1997eada874a

                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      66616c60855f6e1975120c54aeaf401e

                                                                                                                                      SHA1

                                                                                                                                      17b37634209fa91755a2bdb473a12d825a8decf7

                                                                                                                                      SHA256

                                                                                                                                      8718702deb8c21385ea3ae4da03d39063a6377a0b6839c9c8b8bbdb68a8b827e

                                                                                                                                      SHA512

                                                                                                                                      8506aadffbe573e9a8ff19dbb85fff1d9ade23c184a6d5a729a13a9d89e19651d8fd3d68187e1ae42f73f9177c33d171e465f97bf06afd33c17a933955b861d3

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe

                                                                                                                                      Filesize

                                                                                                                                      541KB

                                                                                                                                      MD5

                                                                                                                                      1fc4b9014855e9238a361046cfbf6d66

                                                                                                                                      SHA1

                                                                                                                                      c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                                                                                                      SHA256

                                                                                                                                      f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                                                                                                      SHA512

                                                                                                                                      2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                      MD5

                                                                                                                                      cc90e3326d7b20a33f8037b9aab238e4

                                                                                                                                      SHA1

                                                                                                                                      236d173a6ac462d85de4e866439634db3b9eeba3

                                                                                                                                      SHA256

                                                                                                                                      bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                                                                                                      SHA512

                                                                                                                                      b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                                                                                                    • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      9f318337451085bbe84fc5240468df52

                                                                                                                                      SHA1

                                                                                                                                      09fd5def3ebe585e685304031d9717e24beaf27b

                                                                                                                                      SHA256

                                                                                                                                      0073f9e277df16c500bb0edf800a298bdc3d8268ca93f516320843e6804faba8

                                                                                                                                      SHA512

                                                                                                                                      320cfa3f81f6996b45b5a0b0a265507c7cfd526a44ded120d04d0d93b571e3296a3a21a380c4bea40d9d3ca1902ca4f879defb7716ada8330a7bb303325d309d

                                                                                                                                    • C:\Users\Admin\Pictures\43ARCqskaY0FbudI7Tw9YZ2h.exe

                                                                                                                                      Filesize

                                                                                                                                      4.3MB

                                                                                                                                      MD5

                                                                                                                                      858bb0a3b4fa6a54586402e3ee117076

                                                                                                                                      SHA1

                                                                                                                                      997c31f043347883ea5ed2323a558b6cc5ea9c8e

                                                                                                                                      SHA256

                                                                                                                                      d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35

                                                                                                                                      SHA512

                                                                                                                                      e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

                                                                                                                                    • C:\Users\Admin\Pictures\R1NUY22IcAeZWamyrlQGXb2S.exe

                                                                                                                                      Filesize

                                                                                                                                      344KB

                                                                                                                                      MD5

                                                                                                                                      c8cd5c786dec8862ffcc4f25e183d605

                                                                                                                                      SHA1

                                                                                                                                      dc3d8ae58e706dc7350ea83917bd31a3418b4468

                                                                                                                                      SHA256

                                                                                                                                      df273a2fe7be9ed3aa9059b37196a64e2489371d665aa46b8dc25dcb7d755c31

                                                                                                                                      SHA512

                                                                                                                                      67b614c2c6e0407048e7e990ee2485249d24a19a0b039aff377bb54cc6751e454857f7caacf6baf4b47dccc3ce050ca8d1f26c00473e87248b0325aac12193bd

                                                                                                                                    • C:\Users\Admin\Pictures\Vmxq5Cu78ebPPRLKSUapjz73.exe

                                                                                                                                      Filesize

                                                                                                                                      3KB

                                                                                                                                      MD5

                                                                                                                                      f7a1636b5d42dae1e893ae9caa2cd2db

                                                                                                                                      SHA1

                                                                                                                                      5382b1bd07cb7381d4865ec10831243465bb68e6

                                                                                                                                      SHA256

                                                                                                                                      c5dd4502fe438df7daf9da202b4e129439dd3d086c30571f0e4ae90ee42eed90

                                                                                                                                      SHA512

                                                                                                                                      f8076bf1318ac72504dc89f2598d7e1aab32a36cb7a1b9585c7b13f0f01b08dbc1eef479d1f7f18eb7bcf77a485d92d954110febda2c51570356bab82d1a3181

                                                                                                                                    • C:\Users\Admin\Pictures\WrKWs9Cbc9hGTcGTlrjivtK8.exe

                                                                                                                                      Filesize

                                                                                                                                      7KB

                                                                                                                                      MD5

                                                                                                                                      5b423612b36cde7f2745455c5dd82577

                                                                                                                                      SHA1

                                                                                                                                      0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                      SHA256

                                                                                                                                      e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                      SHA512

                                                                                                                                      c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                    • C:\Users\Admin\Pictures\aeeqYv6dn4JCOeB2IvuNGZmr.exe

                                                                                                                                      Filesize

                                                                                                                                      3KB

                                                                                                                                      MD5

                                                                                                                                      ce7ca7a46e982ac9fd803105a9942c70

                                                                                                                                      SHA1

                                                                                                                                      4b98f8daf7f1c94fe3522492351057e91f588d3c

                                                                                                                                      SHA256

                                                                                                                                      08a607bf166e6961a7de3fd8dbfbd58e646313e3ddc5d4ba65ca37ad491246c4

                                                                                                                                      SHA512

                                                                                                                                      0c6ffe78f2822f5ecef3f0084d0a1e6daa3113aa2ad8a4a5029c753e46f2bb7c05b8d895fc2bc39767d4e6d7b7d9a1056e07e4299f46f2701355dcd885177ff6

                                                                                                                                    • C:\Users\Admin\Pictures\jHH4Ti0JXR2ffsp4PCZaumZL.exe

                                                                                                                                      Filesize

                                                                                                                                      5.1MB

                                                                                                                                      MD5

                                                                                                                                      62f04a66e22159510c6d64de3df41e90

                                                                                                                                      SHA1

                                                                                                                                      a8a6870295ff13c05fe60b6ca353c7aceb81528f

                                                                                                                                      SHA256

                                                                                                                                      7e407f573eea7fd2078a64113c317b9c85e815644bcf7dff6376f2d405f77a2b

                                                                                                                                      SHA512

                                                                                                                                      56701a881a891bf1d8f1f9d0ca25b3843cf5fb0df81d5908b8ca3beff367890fb4b41b314bc4afe16438330213c45b28cec5e9c568dc8f20afa0999515647793

                                                                                                                                    • C:\Users\Admin\Pictures\n1QWiOWXphrNLjUQ4daRcKQV.exe

                                                                                                                                      Filesize

                                                                                                                                      4.1MB

                                                                                                                                      MD5

                                                                                                                                      41cd2170be3c5e2ae1dfc296a97ea397

                                                                                                                                      SHA1

                                                                                                                                      aaab82b8dda1f62482856bf42f6f1e503fa83468

                                                                                                                                      SHA256

                                                                                                                                      331b56a1da2e5b7a46d41a7a8e7cc50519ba594b03784fa4067ba11c52a86920

                                                                                                                                      SHA512

                                                                                                                                      09975ddec87c7e3f37b85be0a8496c822a9fdd0e9f7a226363df24327c75bb5a0b2920b9ef535db2f7c8b6e01fb514918d3989ff639bc4081ee6f578ef677457

                                                                                                                                    • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      ad627d30d51242361bedf9eb08c59cd2

                                                                                                                                      SHA1

                                                                                                                                      c1f74b72f7209324ed48235d1de90571bbf03cd8

                                                                                                                                      SHA256

                                                                                                                                      21ce7dc9687b35373269986d5bfc55da527ce7a4e5fd57977bd27ee79b4302e9

                                                                                                                                      SHA512

                                                                                                                                      ad14b0d4925adffae9e4ad227f8e66ef29c264b5d421f1e471cc28388befb2a1274ee46f51463740f0811d716a05f3a6e81d9ec0ee84c137f7edcca41da71b12

                                                                                                                                    • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                      Filesize

                                                                                                                                      127B

                                                                                                                                      MD5

                                                                                                                                      8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                      SHA1

                                                                                                                                      a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                      SHA256

                                                                                                                                      9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                      SHA512

                                                                                                                                      5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                    • memory/1020-9-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-3-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-11-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-16-0x00000000007E0000-0x0000000000C93000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1020-1-0x0000000077994000-0x0000000077996000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                    • memory/1020-0-0x00000000007E0000-0x0000000000C93000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1020-2-0x00000000007E0000-0x0000000000C93000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/1020-5-0x0000000005440000-0x0000000005441000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-6-0x0000000005490000-0x0000000005491000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-10-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-4-0x0000000005460000-0x0000000005461000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-7-0x0000000005420000-0x0000000005421000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1020-8-0x0000000005430000-0x0000000005431000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1184-131-0x00007FFC21C50000-0x00007FFC22711000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                    • memory/1184-137-0x000000001B020000-0x000000001B030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/1184-127-0x00000000003B0000-0x0000000000432000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      520KB

                                                                                                                                    • memory/1928-260-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                    • memory/1928-256-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                    • memory/2708-315-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                    • memory/2708-310-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                    • memory/2844-424-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-421-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-431-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-464-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-452-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-536-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-462-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2844-460-0x0000000000B00000-0x00000000012A2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.6MB

                                                                                                                                    • memory/2996-136-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-25-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-19-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-623-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-20-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-901-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-22-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-21-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-24-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-497-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-175-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-23-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-26-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-887-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-27-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-318-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-29-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-28-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2996-109-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-799-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/2996-740-0x0000000000330000-0x00000000007E3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.7MB

                                                                                                                                    • memory/3476-67-0x0000000000B00000-0x0000000000CBC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                    • memory/3476-95-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/3476-98-0x0000000003030000-0x0000000005030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32.0MB

                                                                                                                                    • memory/3476-72-0x00000000055D0000-0x00000000055E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3476-66-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/3476-211-0x0000000003030000-0x0000000005030000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32.0MB

                                                                                                                                    • memory/3528-173-0x0000000005940000-0x00000000059B6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      472KB

                                                                                                                                    • memory/3528-135-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/3528-176-0x0000000006120000-0x000000000613E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      120KB

                                                                                                                                    • memory/3528-138-0x0000000004C80000-0x0000000004C90000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/3528-134-0x00000000003C0000-0x0000000000412000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      328KB

                                                                                                                                    • memory/3640-206-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      320KB

                                                                                                                                    • memory/3640-212-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/4108-177-0x00000000006C0000-0x000000000074C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      560KB

                                                                                                                                    • memory/4108-180-0x00007FFC21C50000-0x00007FFC22711000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      10.8MB

                                                                                                                                    • memory/4108-182-0x000000001B5A0000-0x000000001B5B0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4132-111-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/4132-80-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.6MB

                                                                                                                                    • memory/4132-110-0x0000000005380000-0x0000000005390000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4132-222-0x0000000005380000-0x0000000005390000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4160-209-0x0000000002380000-0x0000000004380000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32.0MB

                                                                                                                                    • memory/4160-194-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/4160-210-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/4160-193-0x00000000000E0000-0x000000000015A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      488KB

                                                                                                                                    • memory/4160-201-0x0000000004900000-0x0000000004910000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4372-74-0x00000000052D0000-0x0000000005362000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      584KB

                                                                                                                                    • memory/4372-77-0x00000000063B0000-0x00000000069C8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.1MB

                                                                                                                                    • memory/4372-181-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/4372-108-0x0000000005760000-0x00000000057AC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                    • memory/4372-94-0x00000000055B0000-0x00000000055EC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      240KB

                                                                                                                                    • memory/4372-83-0x0000000005550000-0x0000000005562000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      72KB

                                                                                                                                    • memory/4372-81-0x0000000005650000-0x000000000575A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.0MB

                                                                                                                                    • memory/4372-73-0x00000000057E0000-0x0000000005D84000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/4372-71-0x00000000735A0000-0x0000000073D50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/4372-70-0x00000000009C0000-0x0000000000A10000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      320KB

                                                                                                                                    • memory/4372-76-0x0000000005470000-0x000000000547A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      40KB

                                                                                                                                    • memory/4372-75-0x00000000054A0000-0x00000000054B0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/4372-205-0x00000000054A0000-0x00000000054B0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/5992-535-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/6300-904-0x0000000000400000-0x0000000002F3F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.2MB

                                                                                                                                    • memory/6300-781-0x0000000000400000-0x0000000002F3F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.2MB

                                                                                                                                    • memory/6300-742-0x0000000000400000-0x0000000002F3F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.2MB

                                                                                                                                    • memory/6356-898-0x0000000000400000-0x0000000002F3F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.2MB

                                                                                                                                    • memory/6356-743-0x0000000000400000-0x0000000002F3F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.2MB

                                                                                                                                    • memory/6356-865-0x0000000000400000-0x0000000002F3F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.2MB

                                                                                                                                    • memory/6760-803-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-825-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-822-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-882-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-820-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-819-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-805-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB

                                                                                                                                    • memory/6760-801-0x00007FF62B440000-0x00007FF62BF4A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      11.0MB