Analysis

  • max time kernel
    76s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26/04/2024, 04:26

General

  • Target

    8d9a07546be4fba37841af23d5fac678bf812e3cdd561033a505409f05a1354f.exe

  • Size

    1.8MB

  • MD5

    3d4aba6f79628aa838e56d1a4b125382

  • SHA1

    a66f2a92d6e96b3049249fa06bf23a4488f35730

  • SHA256

    8d9a07546be4fba37841af23d5fac678bf812e3cdd561033a505409f05a1354f

  • SHA512

    5daccde7683fc90f2d470605fff72741bd0f15a12cd2c110cb45ac5233b57342aa6fa78bf5642358adaf4eab3f76f74e0781f30c206965c234cb02ec14e73090

  • SSDEEP

    49152:LZVmyCGasJlF2ytKkoBqL09cA/6KIjTIm:zmyCGaoF2ytKkaqmlIjcm

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

http://185.172.128.76

Attributes
  • url_path

    /c73eed764cc59dcb.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 4 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d9a07546be4fba37841af23d5fac678bf812e3cdd561033a505409f05a1354f.exe
    "C:\Users\Admin\AppData\Local\Temp\8d9a07546be4fba37841af23d5fac678bf812e3cdd561033a505409f05a1354f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3136
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:480
    • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:2916
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:3068
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 884
            3⤵
            • Program crash
            PID:1544
        • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
          "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2692
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:3224
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:664
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                  PID:3220
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                    PID:3140
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5044
                    • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4304
                    • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                      4⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      PID:3952
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                      4⤵
                        PID:5224
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 3
                          5⤵
                            PID:4744
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 424
                        3⤵
                        • Program crash
                        PID:4024
                    • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1272
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        3⤵
                          PID:3824
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 400
                          3⤵
                          • Program crash
                          PID:2732
                      • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2384
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:3212
                        • C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe"
                          3⤵
                          • UAC bypass
                          • Windows security bypass
                          • Executes dropped EXE
                          • Windows security modification
                          • Checks whether UAC is enabled
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:3872
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe" -Force
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5020
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                            4⤵
                              PID:2936
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3560
                              • C:\Users\Admin\Pictures\PMfuf8WfqJ2q8IY4CZ6PhbWy.exe
                                "C:\Users\Admin\Pictures\PMfuf8WfqJ2q8IY4CZ6PhbWy.exe"
                                5⤵
                                  PID:1568
                                  • C:\Users\Admin\AppData\Local\Temp\u17k.0.exe
                                    "C:\Users\Admin\AppData\Local\Temp\u17k.0.exe"
                                    6⤵
                                      PID:2896
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1096
                                        7⤵
                                        • Program crash
                                        PID:5260
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1364
                                        7⤵
                                        • Program crash
                                        PID:244
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1400
                                        7⤵
                                        • Program crash
                                        PID:4720
                                    • C:\Users\Admin\AppData\Local\Temp\u17k.2\run.exe
                                      "C:\Users\Admin\AppData\Local\Temp\u17k.2\run.exe"
                                      6⤵
                                        PID:3784
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\SysWOW64\cmd.exe
                                          7⤵
                                            PID:5312
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              8⤵
                                                PID:4076
                                          • C:\Users\Admin\AppData\Local\Temp\u17k.3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\u17k.3.exe"
                                            6⤵
                                              PID:5192
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1644
                                              6⤵
                                              • Program crash
                                              PID:5808
                                          • C:\Users\Admin\Pictures\rUOwKLKprsQQA5LOPHcWfB35.exe
                                            "C:\Users\Admin\Pictures\rUOwKLKprsQQA5LOPHcWfB35.exe"
                                            5⤵
                                              PID:4156
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                6⤵
                                                  PID:3172
                                                • C:\Users\Admin\Pictures\rUOwKLKprsQQA5LOPHcWfB35.exe
                                                  "C:\Users\Admin\Pictures\rUOwKLKprsQQA5LOPHcWfB35.exe"
                                                  6⤵
                                                    PID:5744
                                                • C:\Users\Admin\Pictures\Mx5YIBPHaqla91UMyWIqudUc.exe
                                                  "C:\Users\Admin\Pictures\Mx5YIBPHaqla91UMyWIqudUc.exe"
                                                  5⤵
                                                    PID:3228
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -nologo -noprofile
                                                      6⤵
                                                        PID:3464
                                                      • C:\Users\Admin\Pictures\Mx5YIBPHaqla91UMyWIqudUc.exe
                                                        "C:\Users\Admin\Pictures\Mx5YIBPHaqla91UMyWIqudUc.exe"
                                                        6⤵
                                                          PID:5704
                                                      • C:\Users\Admin\Pictures\jKDeFrqjBuMmdbJJCMgTgDFR.exe
                                                        "C:\Users\Admin\Pictures\jKDeFrqjBuMmdbJJCMgTgDFR.exe" --silent --allusers=0
                                                        5⤵
                                                          PID:2968
                                                          • C:\Users\Admin\Pictures\jKDeFrqjBuMmdbJJCMgTgDFR.exe
                                                            C:\Users\Admin\Pictures\jKDeFrqjBuMmdbJJCMgTgDFR.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6b0fe1d0,0x6b0fe1dc,0x6b0fe1e8
                                                            6⤵
                                                              PID:4556
                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\jKDeFrqjBuMmdbJJCMgTgDFR.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\jKDeFrqjBuMmdbJJCMgTgDFR.exe" --version
                                                              6⤵
                                                                PID:5200
                                                            • C:\Users\Admin\Pictures\lwq7kncrC3D95UBJYyqKLP19.exe
                                                              "C:\Users\Admin\Pictures\lwq7kncrC3D95UBJYyqKLP19.exe"
                                                              5⤵
                                                                PID:5232
                                                              • C:\Users\Admin\Pictures\2Ozc53aT1p4LCg5tM2A5FirN.exe
                                                                "C:\Users\Admin\Pictures\2Ozc53aT1p4LCg5tM2A5FirN.exe"
                                                                5⤵
                                                                  PID:2072
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4433.tmp\Install.exe
                                                                    .\Install.exe /RvdidblCuX "385118" /S
                                                                    6⤵
                                                                      PID:5540
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                        7⤵
                                                                          PID:4372
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                            8⤵
                                                                              PID:2060
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                9⤵
                                                                                  PID:408
                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                    10⤵
                                                                                      PID:5464
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 04:30:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\hjGlzqq.exe\" em /bZsite_idDKU 385118 /S" /V1 /F
                                                                                7⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:4720
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                          4⤵
                                                                            PID:1492
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:3508
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:1348
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          3⤵
                                                                            PID:4844
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            3⤵
                                                                              PID:2404
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              3⤵
                                                                              • Checks processor information in registry
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4160
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            PID:3328
                                                                            • C:\Windows\system32\rundll32.exe
                                                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                                                              3⤵
                                                                              • Blocklisted process makes network request
                                                                              • Loads dropped DLL
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2556
                                                                              • C:\Windows\system32\netsh.exe
                                                                                netsh wlan show profiles
                                                                                4⤵
                                                                                  PID:3196
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\344820275820_Desktop.zip' -CompressionLevel Optimal
                                                                                  4⤵
                                                                                    PID:2932
                                                                              • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
                                                                                2⤵
                                                                                • UAC bypass
                                                                                • Windows security bypass
                                                                                • Executes dropped EXE
                                                                                • Windows security modification
                                                                                • Checks whether UAC is enabled
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:4360
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
                                                                                  3⤵
                                                                                    PID:1216
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                                                                    3⤵
                                                                                      PID:4652
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                                      3⤵
                                                                                        PID:376
                                                                                        • C:\Users\Admin\Pictures\fhaC16f4tfdz3fI63VIizGKx.exe
                                                                                          "C:\Users\Admin\Pictures\fhaC16f4tfdz3fI63VIizGKx.exe"
                                                                                          4⤵
                                                                                            PID:2684
                                                                                            • C:\Users\Admin\AppData\Local\Temp\u22k.0.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\u22k.0.exe"
                                                                                              5⤵
                                                                                                PID:1752
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 1092
                                                                                                  6⤵
                                                                                                  • Program crash
                                                                                                  PID:5472
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 1316
                                                                                                  6⤵
                                                                                                  • Program crash
                                                                                                  PID:4736
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 1344
                                                                                                  6⤵
                                                                                                  • Program crash
                                                                                                  PID:4712
                                                                                              • C:\Users\Admin\AppData\Local\Temp\u22k.2\run.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\u22k.2\run.exe"
                                                                                                5⤵
                                                                                                  PID:5904
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\SysWOW64\cmd.exe
                                                                                                    6⤵
                                                                                                      PID:5576
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                        7⤵
                                                                                                          PID:1860
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\u22k.3.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\u22k.3.exe"
                                                                                                      5⤵
                                                                                                        PID:5956
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                                                                                          6⤵
                                                                                                            PID:5256
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1020
                                                                                                          5⤵
                                                                                                          • Program crash
                                                                                                          PID:6076
                                                                                                      • C:\Users\Admin\Pictures\6ererPoGtcOtEVxKse1dtAYj.exe
                                                                                                        "C:\Users\Admin\Pictures\6ererPoGtcOtEVxKse1dtAYj.exe"
                                                                                                        4⤵
                                                                                                          PID:3788
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -nologo -noprofile
                                                                                                            5⤵
                                                                                                              PID:4708
                                                                                                            • C:\Users\Admin\Pictures\6ererPoGtcOtEVxKse1dtAYj.exe
                                                                                                              "C:\Users\Admin\Pictures\6ererPoGtcOtEVxKse1dtAYj.exe"
                                                                                                              5⤵
                                                                                                                PID:3764
                                                                                                            • C:\Users\Admin\Pictures\xtfBWleE4m4UtbE8Y8D1nHda.exe
                                                                                                              "C:\Users\Admin\Pictures\xtfBWleE4m4UtbE8Y8D1nHda.exe"
                                                                                                              4⤵
                                                                                                                PID:388
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -nologo -noprofile
                                                                                                                  5⤵
                                                                                                                    PID:5344
                                                                                                                  • C:\Users\Admin\Pictures\xtfBWleE4m4UtbE8Y8D1nHda.exe
                                                                                                                    "C:\Users\Admin\Pictures\xtfBWleE4m4UtbE8Y8D1nHda.exe"
                                                                                                                    5⤵
                                                                                                                      PID:4032
                                                                                                                  • C:\Users\Admin\Pictures\YiNhccxIqe3bgD8U6rAwVBxF.exe
                                                                                                                    "C:\Users\Admin\Pictures\YiNhccxIqe3bgD8U6rAwVBxF.exe"
                                                                                                                    4⤵
                                                                                                                      PID:3612
                                                                                                                    • C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe
                                                                                                                      "C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe" --silent --allusers=0
                                                                                                                      4⤵
                                                                                                                        PID:5052
                                                                                                                        • C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe
                                                                                                                          C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6c22e1d0,0x6c22e1dc,0x6c22e1e8
                                                                                                                          5⤵
                                                                                                                            PID:1216
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\fMgNIkbJs17kD8c9YqQ8EpRv.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\fMgNIkbJs17kD8c9YqQ8EpRv.exe" --version
                                                                                                                            5⤵
                                                                                                                              PID:2244
                                                                                                                            • C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe
                                                                                                                              "C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5052 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240426042829" --session-guid=66a6353b-79b1-4bc2-b197-e8f1e2113572 --server-tracking-blob="OWExZTMwY2JjYTJiMDE4YWY0Zjk0NTMzNDEwYmM0OGRlMGE1NGYwMjNhOTRkZDRmNTkzN2E4ZDkwYWZiYTM5Mzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MTA1Njk5LjU4MzMiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiZGE1OTJjMDYtZTI2Yy00NjM5LThhMmMtNmE1NzE2YzE3ZTllIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6004000000000000
                                                                                                                              5⤵
                                                                                                                                PID:2700
                                                                                                                                • C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe
                                                                                                                                  C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6b5be1d0,0x6b5be1dc,0x6b5be1e8
                                                                                                                                  6⤵
                                                                                                                                    PID:2960
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:5492
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\assistant\assistant_installer.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\assistant\assistant_installer.exe" --version
                                                                                                                                    5⤵
                                                                                                                                      PID:2352
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\assistant\assistant_installer.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x8d6038,0x8d6044,0x8d6050
                                                                                                                                        6⤵
                                                                                                                                          PID:4588
                                                                                                                                    • C:\Users\Admin\Pictures\bFRj0lMVx30eSwr2NCoC74pR.exe
                                                                                                                                      "C:\Users\Admin\Pictures\bFRj0lMVx30eSwr2NCoC74pR.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:388
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS96B8.tmp\Install.exe
                                                                                                                                          .\Install.exe /RvdidblCuX "385118" /S
                                                                                                                                          5⤵
                                                                                                                                            PID:3992
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:5036
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
                                                                                                                                        2⤵
                                                                                                                                          PID:1036
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
                                                                                                                                            3⤵
                                                                                                                                              PID:2376
                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                Sc delete GameServerClient
                                                                                                                                                4⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:1384
                                                                                                                                              • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                GameService remove GameServerClient confirm
                                                                                                                                                4⤵
                                                                                                                                                  PID:3004
                                                                                                                                                • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                  GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2396
                                                                                                                                                  • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                    GameService start GameServerClient
                                                                                                                                                    4⤵
                                                                                                                                                      PID:5296
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5768
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        Sc delete GameServerClientC
                                                                                                                                                        4⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:5892
                                                                                                                                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                        GameService remove GameServerClientC confirm
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5908
                                                                                                                                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                          GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:5932
                                                                                                                                                          • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                            GameService start GameServerClientC
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5952
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                                                                                                                                            3⤵
                                                                                                                                                              PID:992
                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2804
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2364 -ip 2364
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3556
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2692 -ip 2692
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4652
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1272 -ip 1272
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3852
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2132
                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4272
                                                                                                                                                                    • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                                      "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5352
                                                                                                                                                                        • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                                                                                                          "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5672
                                                                                                                                                                            • C:\Windows\Temp\506436.exe
                                                                                                                                                                              "C:\Windows\Temp\506436.exe" --list-devices
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5700
                                                                                                                                                                          • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                                            "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5968
                                                                                                                                                                              • C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
                                                                                                                                                                                "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6028
                                                                                                                                                                                  • C:\Windows\Temp\287874.exe
                                                                                                                                                                                    "C:\Windows\Temp\287874.exe" --coin BTC -m ADDRESSES -t 0 --range 2ca0743d700000000:2ca0743d740000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6120
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1752 -ip 1752
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4828
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1752 -ip 1752
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:6040
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1752 -ip 1752
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5752
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2896 -ip 2896
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:6128
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2896 -ip 2896
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5216
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2896 -ip 2896
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3444
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2684 -ip 2684
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5200
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:5268
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1568 -ip 1568
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4296

                                                                                                                                                                                                  Network

                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                        • C:\Program Files (x86)\GameServerClient\GameService.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          288KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                                        • C:\Program Files (x86)\GameServerClient\installg.bat

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          238B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b6b57c523f3733580d973f0f79d5c609

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2cc30cfd66817274c84f71d46f60d9e578b7bf95

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7

                                                                                                                                                                                                        • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          593KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          944B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7d760ca2472bcb9fe9310090d91318ce

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          cb316b8560b38ea16a17626e685d5a501cd31c4a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          56db2d5d39a37ae11509ae38d8ee0385

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          1d279f51fc0c546f05c561a24861f3ce1469386a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4f5a4d243fa9daad396510c711bcff839a315e71aadf59f2a5e7325ee1b5b788

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          af9a425fddd1d6f9d39bc7fb12137e7c05f24cef65b49d7f65eb4b50fb6daa0050a865d91a26b820d3cc9e67351a6c067032f746c718fa0ece1ecef25e53eaaf

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\additional_file0.tmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.5MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260428291\opera_package

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          63.4MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          add8113190da0a7e1aa0e309cb666e6e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          c4d9ee6155648bf16945a73d5587f26609a2e608

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b807fc970ea238f94e6bdc6ef0365563d74175aec6ee212839ee152adb0885ba

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          91841dedc060eee156d8bf4770ffb9a23dc05f54bcf551129590970b160a9c10cc1848265e5c221853070b1d96e4a8f6180fd7d82d1697491ffb1de32093015e

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          321KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.7MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          460KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b22521fb370921bb5d69bf8deecce59e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          418KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          8510bcf5bc264c70180abe78298e4d5b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          158KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          586f7fecacd49adab650fae36e2db994

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          676KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          54e30b1ca3a46a4e8cb293e0321a12c3

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e75bf8a99d2712545efc6e5c82a7b5906419208b

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          907172368a603ddc2f63d3444876f127bc21e4bb598985271e09dfbe15d4691f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1c26c8e1d13889b2b3deeb2648dfb4e6d37f30b29bb8802fe18762c3799cc381933b8c5795a9fc283a91887a706490949411300f53aedff72124d92fca0edb44

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.4MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          6184676075afacb9103ae8cbf542c1ed

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          bc757642ad2fcfd6d1da79c0754323cdc823a937

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          669KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          728a9d70eb2494e89873b0cbdc3ba430

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d69c4d7be694e0095058899613156e2452c1bc21

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          73e9463ce5ada7f99d693375e99bb7fa71624cd061c3cde643a2fd0083c5d1d7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8022e70e1355d1ef03c84749ece42fdc9b1d868e0c1be6222eba6e23a4b94862585f777aa62907e13e955eafe2508f340ac46aefab6c6e8060c9054e63d2a615

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.8MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3d4aba6f79628aa838e56d1a4b125382

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a66f2a92d6e96b3049249fa06bf23a4488f35730

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          8d9a07546be4fba37841af23d5fac678bf812e3cdd561033a505409f05a1354f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5daccde7683fc90f2d470605fff72741bd0f15a12cd2c110cb45ac5233b57342aa6fa78bf5642358adaf4eab3f76f74e0781f30c206965c234cb02ec14e73090

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS96B8.tmp\Install.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          6.8MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          e77964e011d8880eae95422769249ca4

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404260428279945052.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          45fe60d943ad11601067bc2840cc01be

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          911d70a6aad7c10b52789c0312c5528556a2d609

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Tmp7143.tmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jrukiczl.tzr.ps1

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          60B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9a72658dd70407cd9587b3d327bd9055

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          28b48d76629c15b045b6ca045262e9c1a61375bc

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a49f082ecee9ae05aab2137b22280013e02f452c0bf7f07776c0c3549772658c

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d36fafd13c3251be6235b468ad6a9feb8ac5a92aa1950db97fca66ce731b8e97912f57734813733f6390127dd418475045fb774b55b08b589b5a6568f304b606

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a5d41f4380108fa497ad1eea80ba1beb

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          28587a24e252e91b6d149748d792b047ae57af73

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7fbe9fd73147562e6c660912e7e27c337d8301091e42806dcae6208bcb1b4f7a

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          de1e2d636924bbc60b4495318dc45415575edadbbb5134b308b34e66ef095f99811b5ca80b6e0ad8c9ff94c278169cce46d2f03b937bfe64bc6e60ccc64012f6

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp865E.tmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          42c395b8db48b6ce3d34c301d1eba9d5

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b7cfa3de344814bec105391663c0df4a74310996

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp877A.tmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          20KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          22be08f683bcc01d7a9799bbd2c10041

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2efb6041cf3d6e67970135e592569c76fc4c41de

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u17k.1.zip

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          3.7MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u17k.2\run.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.4MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u22k.0.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          252KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          92c44b47adc5e94d871e853a990630b7

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5a7baf9d065fe9ee4e9e68dafb4f1836c19654ad

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          fd496043352e900780ba0ded51df57cd7ac6507ad916ff46fe2cff52e2b8e720

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          3d8c0a5bb8c33504c44fda7e0e9ebc784b7dd0a30761922cb1858e032dfdc2a4b0cf5cd251c7c9cbb42923b0f24b07242d3fc76501cacaa4da83201c69572e5f

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u22k.2\UIxMarketPlugin.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d1ba9412e78bfc98074c5d724a1a87d6

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0572f98d78fb0b366b5a086c2a74cc68b771d368

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u22k.2\bunch.dat

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          1e8237d3028ab52821d69099e0954f97

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          30a6ae353adda0c471c6ed5b7a2458b07185abf2

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u22k.2\relay.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          10d51becd0bbce0fab147ff9658c565e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u22k.2\whale.dbf

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          85KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          a723bf46048e0bfb15b8d77d7a648c3e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          8952d3c34e9341e4425571e10f22b782695bb915

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u22k.3.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.6MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b40687514354d585eff256fe7de9d287

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b62a0ffc40d8ca061c37ddcecab28e976d3ad099

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          59aff682f8cd6d6bd875fe528a6b5324775b5df01d7e08f9eb1374099d4272f8

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          483131395530d9515a6e81eee02880b427c2059d7eb704722ee2093f64c53d699aa8a4b613f0441ed60c5dc6de04f96b0b7ed405dce1ad4d34503cd8ce230e8d

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          109KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          154c3f1334dd435f562672f2664fea6b

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          f35b671fda2603ec30ace10946f11a90

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          059ad6b06559d4db581b1879e709f32f80850872

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0c582da789c91878ab2f1b12d7461496

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          750KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          3580aba10bb8006ab9f582ff875628cc

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          755d188b8873ec335ff1f301d648a2ec49dd5388

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          4bbcf9f66736ae405bddef72f8961e3f295cee86ee2bbe2cdf693d10e9eca670

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d3f910e55ae8d9e4d0e22bd9b6ef9a940d0b272db555864472d0bb20622fcdddbf18b1343313b05eea1eefeaadd53ff4adbfd4ed0fb690e645510a27c42f1f34

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\2Ozc53aT1p4LCg5tM2A5FirN.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          6.8MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d981fb3fc1f28bea729db051c75dae08

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          d5eea12045a6d998da1a362f70748fc09874d0b4

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Mx5YIBPHaqla91UMyWIqudUc.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.1MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          03531611da083e20c3131f47f5923e52

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          cc4ef0b6e9524ec74d4c95bb7dbf7981590f1ee2

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          fbd0606b08bb98e955f5815d30cdc8e4069ec731b7dcee2c650eb4538cbfe30b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          11927c886935989e3a5f9c44127138b97dbc421b91986ffa5f726c6634d955060fe04b8f1daf2669ff879c6bdccde69a0ffac718247292ade19bddaf996a69f9

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\PMfuf8WfqJ2q8IY4CZ6PhbWy.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          395KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          71c036b28ca03baf96cc1cbfcfb7281e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          bdf33cd1ced7176f06c7210a36c48faf57e4227e

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          ba9cbc88e931954d07f5c067e67699d3a91cf9e0917a4ccd4e5065296f2da80b

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c4964e78ab408f0f72a77c7956aa2bb502633fe77e40daea840e4b7e3cfc2d119f083ab9c12c02a88f1a053f2529285fa31626c933ff9d3e0f10a99ea4e202b8

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\T2zwe9E00J1Ukjv7VpEwlltI.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\YiNhccxIqe3bgD8U6rAwVBxF.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.4MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          69f6614893028c60394f744c7ebc1551

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\fMgNIkbJs17kD8c9YqQ8EpRv.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.1MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          b46256c85fda31c9b25ee4fd138c6a5e

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          174d427e48c4969accd0f65826a9ff6425c07359

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          15ee148d20a5b933a6c721944c57199d0ff6848b77a9f011f38b336bcf4174db

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          d1cd451d76c256c831660f63baa2eeb037ab57dd7e17fb417e1c2a5ec558e9247c29e8350e12af4c7045cbd3d40f664b245a869d2b438968a455a8f4638ea3b0

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\fhaC16f4tfdz3fI63VIizGKx.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          395KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          d39b7113410bf19d48d1f656c0ab009c

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          133ff7840b78b98d639f14ebcc33ad8907503ca5

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          66b56c58735b627dedd96cd9e079be2f0a167df42b15932f054e6e2013c8ce41

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          aac3a59575c6ad91c756f68b37419fe6d90ed1c3f2a481ab4d774353dec462ea9e08e00711b990c0307078ed740360d5d651f3454cd76cff1e71ce0afa10fc77

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\jKDeFrqjBuMmdbJJCMgTgDFR.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.1MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          22636316888c8f4a712ff3fdaafe6ba8

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          bba98ee4ab1f31dda7eeb6d10c3a2d4526595f55

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          d0374e051de0ee2e64e84a0520f577c0868523c12d03bc16e1268ec599e3c8c9

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          9bc3f17833c3a7226270b5f1c88acface5757d7fb9f94a2aa0c495552e04dad6f47be646380a36addafebe39bd8a1e8d4d4c811dff5184fdc2d27cf0539259f8

                                                                                                                                                                                                        • C:\Users\Admin\Pictures\lwq7kncrC3D95UBJYyqKLP19.exe

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.7MB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          806f295ff14699677790ca246cb69864

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          5ff2e05176ea77a6a12ed50ac8836757dd342829

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          8f1fb3595585747a418c6fc186c36e3c0a98d80cc81c5df56e8faeb5b2421fb6

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ecb12e1d799c107f39b998851938b428b1d81906615505aff3ab8426bba06d9d827e29405d8de26761341e57ef38c059d6ec68309df938326771c11dde7175a8

                                                                                                                                                                                                        • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2KB

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          0517d0fc1c39f6ff3e3c8386e8a308cb

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          b9bdb922201db566f2443faba6393f84cfc58e24

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          0e8b523db226b53ee9ea6e66d3affb3b99870f1f837b1149978d27e999e05ce2

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          4960f1294e05c254d04d2e3d4c5940ed3461b7384f88c351fed1879de1e28e385b94bc04a6b9ef012f80eca00d45e4c008ffdc07bfd93234551cbd81c9d65681

                                                                                                                                                                                                        • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          127B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                        • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          127B

                                                                                                                                                                                                          MD5

                                                                                                                                                                                                          7cc972a3480ca0a4792dc3379a763572

                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                          f72eb4124d24f06678052706c542340422307317

                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                          02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                          ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

                                                                                                                                                                                                        • memory/376-345-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          32KB

                                                                                                                                                                                                        • memory/388-1009-0x0000000000400000-0x0000000002EE0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          42.9MB

                                                                                                                                                                                                        • memory/480-535-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-21-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/480-22-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/480-23-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/480-78-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-955-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-140-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-17-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-25-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/480-689-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-18-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-24-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/480-19-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/480-101-0x0000000000230000-0x00000000006E5000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/480-20-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/1216-533-0x0000013A50EF0000-0x0000013A5103F000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                        • memory/1272-120-0x0000000000600000-0x0000000000674000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          464KB

                                                                                                                                                                                                        • memory/1348-242-0x0000000000500000-0x000000000052E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          184KB

                                                                                                                                                                                                        • memory/1568-675-0x0000000000400000-0x0000000002B21000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          39.1MB

                                                                                                                                                                                                        • memory/1568-910-0x0000000000400000-0x0000000002B21000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          39.1MB

                                                                                                                                                                                                        • memory/1752-1083-0x0000000000400000-0x0000000002AFD000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          39.0MB

                                                                                                                                                                                                        • memory/2364-56-0x0000000073590000-0x0000000073D41000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                        • memory/2364-46-0x0000000073590000-0x0000000073D41000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                        • memory/2364-53-0x0000000002770000-0x0000000004770000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          32.0MB

                                                                                                                                                                                                        • memory/2364-45-0x00000000001D0000-0x0000000000222000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          328KB

                                                                                                                                                                                                        • memory/2684-1097-0x0000000000400000-0x0000000002B21000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          39.1MB

                                                                                                                                                                                                        • memory/2684-661-0x0000000000400000-0x0000000002B21000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          39.1MB

                                                                                                                                                                                                        • memory/2692-74-0x0000000000510000-0x00000000007C8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.7MB

                                                                                                                                                                                                        • memory/2932-560-0x0000013E34920000-0x0000013E34A6F000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                        • memory/3068-52-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                        • memory/3068-54-0x0000000001240000-0x0000000001241000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3068-55-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                        • memory/3068-49-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                        • memory/3136-4-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-5-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-2-0x00000000004E0000-0x0000000000995000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/3136-1-0x0000000077BD6000-0x0000000077BD8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          8KB

                                                                                                                                                                                                        • memory/3136-6-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-7-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-0-0x00000000004E0000-0x0000000000995000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/3136-3-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-8-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-9-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4KB

                                                                                                                                                                                                        • memory/3136-14-0x00000000004E0000-0x0000000000995000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                        • memory/3228-1004-0x0000000000400000-0x0000000002EE0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          42.9MB

                                                                                                                                                                                                        • memory/3508-185-0x0000000005810000-0x0000000005886000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          472KB

                                                                                                                                                                                                        • memory/3508-165-0x0000000000330000-0x0000000000382000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          328KB

                                                                                                                                                                                                        • memory/3508-203-0x0000000006390000-0x00000000063CC000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          240KB

                                                                                                                                                                                                        • memory/3508-200-0x0000000006330000-0x0000000006342000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                        • memory/3508-199-0x00000000063F0000-0x00000000064FA000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                        • memory/3508-189-0x00000000068A0000-0x0000000006EB8000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                        • memory/3508-186-0x0000000006160000-0x000000000617E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          120KB

                                                                                                                                                                                                        • memory/3508-164-0x0000000073590000-0x0000000073D41000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                        • memory/3508-170-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                        • memory/3508-209-0x0000000006500000-0x000000000654C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          304KB

                                                                                                                                                                                                        • memory/3508-166-0x00000000051E0000-0x0000000005786000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                        • memory/3508-167-0x0000000004D10000-0x0000000004DA2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          584KB

                                                                                                                                                                                                        • memory/3508-168-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          40KB

                                                                                                                                                                                                        • memory/3560-310-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          32KB

                                                                                                                                                                                                        • memory/3784-1074-0x000000006EB50000-0x000000006ECCD000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                        • memory/3784-917-0x00007FF9A6720000-0x00007FF9A6929000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                        • memory/3784-915-0x000000006EB50000-0x000000006ECCD000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                        • memory/3788-698-0x0000000000400000-0x0000000002EE0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          42.9MB

                                                                                                                                                                                                        • memory/3788-1008-0x0000000000400000-0x0000000002EE0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          42.9MB

                                                                                                                                                                                                        • memory/3824-119-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          312KB

                                                                                                                                                                                                        • memory/3824-122-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          312KB

                                                                                                                                                                                                        • memory/3824-123-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          312KB

                                                                                                                                                                                                        • memory/3872-240-0x000001C738460000-0x000001C738470000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                        • memory/3872-234-0x00007FF9856B0000-0x00007FF986172000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                        • memory/3872-231-0x000001C7367B0000-0x000001C736800000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          320KB

                                                                                                                                                                                                        • memory/3872-238-0x000001C738400000-0x000001C73845E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          376KB

                                                                                                                                                                                                        • memory/4156-978-0x0000000000400000-0x0000000002EE0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          42.9MB

                                                                                                                                                                                                        • memory/4156-690-0x0000000000400000-0x0000000002EE0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          42.9MB

                                                                                                                                                                                                        • memory/4160-260-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.2MB

                                                                                                                                                                                                        • memory/4160-434-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          972KB

                                                                                                                                                                                                        • memory/4160-256-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.2MB

                                                                                                                                                                                                        • memory/4304-99-0x00000000000F0000-0x00000000001B0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          768KB

                                                                                                                                                                                                        • memory/4304-141-0x000000001D4C0000-0x000000001D5CA000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                        • memory/4304-100-0x00007FF9856B0000-0x00007FF986172000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                        • memory/4304-236-0x000000001E720000-0x000000001EC48000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          5.2MB

                                                                                                                                                                                                        • memory/4304-102-0x000000001AE40000-0x000000001AE50000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                        • memory/4304-239-0x00007FF9856B0000-0x00007FF986172000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                        • memory/4304-235-0x000000001E020000-0x000000001E1E2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.8MB

                                                                                                                                                                                                        • memory/4304-144-0x000000001BD50000-0x000000001BD8C000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          240KB

                                                                                                                                                                                                        • memory/4304-222-0x000000001B1B0000-0x000000001B1CE000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          120KB

                                                                                                                                                                                                        • memory/4304-143-0x000000001B1D0000-0x000000001B1E2000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          72KB

                                                                                                                                                                                                        • memory/4304-212-0x000000001D9D0000-0x000000001DA46000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          472KB

                                                                                                                                                                                                        • memory/4304-142-0x000000001AE40000-0x000000001AE50000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                        • memory/5044-169-0x0000000073590000-0x0000000073D41000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                        • memory/5044-237-0x00000000054B0000-0x00000000054C0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                        • memory/5044-79-0x00000000054B0000-0x00000000054C0000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          64KB

                                                                                                                                                                                                        • memory/5044-77-0x0000000073590000-0x0000000073D41000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                        • memory/5044-73-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                        • memory/5232-1086-0x0000000140000000-0x000000014075E000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          7.4MB

                                                                                                                                                                                                        • memory/5312-1101-0x00007FF9A6720000-0x00007FF9A6929000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                        • memory/5904-1095-0x000000006EB50000-0x000000006ECCD000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                        • memory/5904-1012-0x00007FF9A6720000-0x00007FF9A6929000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                        • memory/5904-1010-0x000000006EB50000-0x000000006ECCD000-memory.dmp

                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                          1.5MB