Analysis

  • max time kernel
    157s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 18:27

General

  • Target

    951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe

  • Size

    1.8MB

  • MD5

    93338c2f6145798dfafcee30c199e20f

  • SHA1

    5b7d99b4c1d83ff9ee31bc4c548c32b80f976597

  • SHA256

    951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787

  • SHA512

    b9596186abd820f85c2e72a6354bea9ab323ed75f4bfd7a815e8afebc5e25611e246948d7ed22bac934a114c9a309defeff149747751195ca98db24846e735cf

  • SSDEEP

    49152:JaDmc7gRoXqaNbUcoqFGax4koKkekln1FP3j4gV:JdXRoXqU4vax4kogkVbzBV

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

amadey

Version

4.12

C2

http://185.172.128.19

Attributes
  • install_dir

    cd1f156d67

  • install_file

    Utsysc.exe

  • strings_key

    0dd3e5ee91b367c60c9e575983554b30

  • url_paths

    /ghsdh39s/index.php

rc4.plain

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

http://185.172.128.150

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

91.92.252.220:7000

41.199.23.195:7000

saveclinetsforme68465454711991.publicvm.com:7000

Mutex

bBT8anvIxhxDFmkf

Attributes
  • Install_directory

    %AppData%

  • install_file

    explorer.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

aes.plain

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 7 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Stealc

    Stealc is an infostealer written in C++.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe
    "C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:3812
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1320
    • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
      C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5188
      • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
        "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:5796
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 868
            3⤵
            • Program crash
            PID:3728
        • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
          "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2376
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4188
              • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                4⤵
                  PID:5312
                • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                  4⤵
                    PID:4092
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 332
                  3⤵
                  • Program crash
                  PID:5144
              • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4144
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                    PID:5164
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 356
                    3⤵
                    • Program crash
                    PID:3800
                • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
                  2⤵
                    PID:5168
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                      3⤵
                      • Creates scheduled task(s)
                      PID:4224
                    • C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"
                      3⤵
                        PID:5352
                        • C:\Users\Admin\AppData\Local\Temp\u44o.0.exe
                          "C:\Users\Admin\AppData\Local\Temp\u44o.0.exe"
                          4⤵
                            PID:4588
                          • C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe
                            "C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe"
                            4⤵
                              PID:1644
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\SysWOW64\cmd.exe
                                5⤵
                                  PID:5428
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                    6⤵
                                      PID:4320
                                • C:\Users\Admin\AppData\Local\Temp\u44o.3.exe
                                  "C:\Users\Admin\AppData\Local\Temp\u44o.3.exe"
                                  4⤵
                                    PID:5628
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 1552
                                    4⤵
                                    • Program crash
                                    PID:4992
                                • C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"
                                  3⤵
                                    PID:3304
                                  • C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                    3⤵
                                      PID:3236
                                  • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                                    2⤵
                                      PID:2812
                                    • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                                      2⤵
                                        PID:872
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          3⤵
                                            PID:5780
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                              PID:2512
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                            2⤵
                                              PID:2984
                                              • C:\Windows\system32\rundll32.exe
                                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                                3⤵
                                                  PID:5808
                                                  • C:\Windows\system32\netsh.exe
                                                    netsh wlan show profiles
                                                    4⤵
                                                      PID:5032
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
                                                      4⤵
                                                        PID:5220
                                                  • C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"
                                                    2⤵
                                                      PID:4892
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                                        3⤵
                                                          PID:1620
                                                          • C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe
                                                            "C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe"
                                                            4⤵
                                                              PID:4424
                                                              • C:\Users\Admin\AppData\Local\Temp\u3ew.0.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\u3ew.0.exe"
                                                                5⤵
                                                                  PID:1660
                                                                • C:\Users\Admin\AppData\Local\Temp\u3ew.2\run.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\u3ew.2\run.exe"
                                                                  5⤵
                                                                    PID:2720
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\SysWOW64\cmd.exe
                                                                      6⤵
                                                                        PID:5696
                                                                    • C:\Users\Admin\AppData\Local\Temp\u3ew.3.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\u3ew.3.exe"
                                                                      5⤵
                                                                        PID:5856
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1584
                                                                        5⤵
                                                                        • Program crash
                                                                        PID:5348
                                                                    • C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe
                                                                      "C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe"
                                                                      4⤵
                                                                        PID:2392
                                                                      • C:\Users\Admin\Pictures\fwR9Od4wGbyLYnJHYdxA0AAn.exe
                                                                        "C:\Users\Admin\Pictures\fwR9Od4wGbyLYnJHYdxA0AAn.exe"
                                                                        4⤵
                                                                          PID:2428
                                                                        • C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
                                                                          "C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe" --silent --allusers=0
                                                                          4⤵
                                                                            PID:2308
                                                                            • C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
                                                                              C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b43e1d0,0x6b43e1dc,0x6b43e1e8
                                                                              5⤵
                                                                                PID:1556
                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eX4X2LwZyW6G8seCoyRNE6va.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eX4X2LwZyW6G8seCoyRNE6va.exe" --version
                                                                                5⤵
                                                                                  PID:4036
                                                                                • C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
                                                                                  "C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2308 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240428182954" --session-guid=42bf30bf-b94e-41f9-92b1-acd4584c9541 --server-tracking-blob="M2I3OWI3YWRiMDNlZTk0YzYzMzNiMzU5YTZiZGU4MDlkMjczNzFjMTk4YzAyMWVkZDhkNDQwNzg5YjgxNGEyNTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MzI4OTc0LjcxMzUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMjFkNjA2ZmUtMTgyOS00OGIyLWI3MGQtNmE0NTI0YjRmZjVkIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3405000000000000
                                                                                  5⤵
                                                                                    PID:2044
                                                                                    • C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
                                                                                      C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6a91e1d0,0x6a91e1dc,0x6a91e1e8
                                                                                      6⤵
                                                                                        PID:6100
                                                                                  • C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe
                                                                                    "C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe"
                                                                                    4⤵
                                                                                      PID:5384
                                                                                    • C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe
                                                                                      "C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe"
                                                                                      4⤵
                                                                                        PID:4348
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSF301.tmp\Install.exe
                                                                                          .\Install.exe /WkfdidVYT "385118" /S
                                                                                          5⤵
                                                                                            PID:1588
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                              6⤵
                                                                                                PID:3952
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                  7⤵
                                                                                                    PID:396
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                      8⤵
                                                                                                        PID:5092
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                          9⤵
                                                                                                            PID:4532
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                        7⤵
                                                                                                          PID:5036
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                            8⤵
                                                                                                              PID:4384
                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                9⤵
                                                                                                                  PID:4016
                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                              7⤵
                                                                                                                PID:5132
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                  8⤵
                                                                                                                    PID:5072
                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                      9⤵
                                                                                                                        PID:2180
                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                                  6⤵
                                                                                                                    PID:3604
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                      7⤵
                                                                                                                        PID:4864
                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                          8⤵
                                                                                                                            PID:3120
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 18:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSF301.tmp\Install.exe\" Wt /LOwdidUswJ 385118 /S" /V1 /F
                                                                                                                        6⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:5412
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"
                                                                                                                2⤵
                                                                                                                  PID:6124
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe'
                                                                                                                    3⤵
                                                                                                                      PID:2600
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mstc.exe'
                                                                                                                      3⤵
                                                                                                                        PID:5328
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'
                                                                                                                        3⤵
                                                                                                                          PID:5192
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                                                                                                        2⤵
                                                                                                                          PID:968
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
                                                                                                                        1⤵
                                                                                                                          PID:3120
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1972 -ip 1972
                                                                                                                          1⤵
                                                                                                                            PID:3188
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4144 -ip 4144
                                                                                                                            1⤵
                                                                                                                              PID:4072
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5352 -ip 5352
                                                                                                                              1⤵
                                                                                                                                PID:3920
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4424 -ip 4424
                                                                                                                                1⤵
                                                                                                                                  PID:3324
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:6084
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                    1⤵
                                                                                                                                      PID:1404
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:5752

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        f6eba5b4da2a6729ce49739376f04e87

                                                                                                                                        SHA1

                                                                                                                                        564f12037877a6b7cf73c4b130882f27375d6e2c

                                                                                                                                        SHA256

                                                                                                                                        b5d2109699d2e485bf989aa7595ab2877b6d59fa781364b9b2a6b64652a3a2e1

                                                                                                                                        SHA512

                                                                                                                                        a9327f2592d15eae2703bfe202c3c85d3353aeef6a0863571e9a15b7d73854bd8ee83c2e6e0f190d40ee3b471c43f98068f6f4bda2283b8d33b62e7cb29ec9a5

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                                                                                                                        Filesize

                                                                                                                                        724B

                                                                                                                                        MD5

                                                                                                                                        8202a1cd02e7d69597995cabbe881a12

                                                                                                                                        SHA1

                                                                                                                                        8858d9d934b7aa9330ee73de6c476acf19929ff6

                                                                                                                                        SHA256

                                                                                                                                        58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                                                                                                                        SHA512

                                                                                                                                        97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                                        Filesize

                                                                                                                                        410B

                                                                                                                                        MD5

                                                                                                                                        de8c64f6de430a91824ea4c81a8f6626

                                                                                                                                        SHA1

                                                                                                                                        6770a37b4303b2d2283d717252124ae952c8680f

                                                                                                                                        SHA256

                                                                                                                                        bef0bec14016c178fda6f5fb360b84513f8151a41273f78332e456a7aae2a14e

                                                                                                                                        SHA512

                                                                                                                                        5395b6082ea5f9c6383b80e4c02c4454697eef35b99ece7ca4dbf7993e491ebe4a5838b81af09f93bcd50af294f8e5dbead3239d2eba8655225d14d969ccf2ec

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                                                                                                                        Filesize

                                                                                                                                        392B

                                                                                                                                        MD5

                                                                                                                                        8377d7254b54a60a3a0bd0190a7d79ce

                                                                                                                                        SHA1

                                                                                                                                        b6fb14e921eb60f0f8bbaac0fc2931dd8e3937b0

                                                                                                                                        SHA256

                                                                                                                                        6583bb1661fe9d5c8691eec3e59d06db0f73be85adb2b3144bef26b09b9658f1

                                                                                                                                        SHA512

                                                                                                                                        7be324dbd1d06c5dfd4af28f1cfcc9866456487ae5db4ca82a9c3a642205d65387bf6f16a9474b670670773e7ad58293cc329604aaa5440a75f6fa7d0135a0b6

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                        SHA1

                                                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                        SHA256

                                                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                        SHA512

                                                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        0161e4d30ea0c945f2d2a2185e8133a4

                                                                                                                                        SHA1

                                                                                                                                        87b1b2b12534d7074de9e8ba84c177bbd67c7435

                                                                                                                                        SHA256

                                                                                                                                        45d834d5bbfad1d69dce8ad1cd68152de37c767e1203967e07a2a589df00e2e3

                                                                                                                                        SHA512

                                                                                                                                        89d6222d5b4add85ec76428b652e5dd831f399d447c1894167b4197c57ea0438d2cb154604105a2973898371e1c827a28156200ed1e0e88bb492b2a19af11b62

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

                                                                                                                                        Filesize

                                                                                                                                        321KB

                                                                                                                                        MD5

                                                                                                                                        1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                        SHA1

                                                                                                                                        33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                        SHA256

                                                                                                                                        e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                        SHA512

                                                                                                                                        53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

                                                                                                                                        Filesize

                                                                                                                                        2.7MB

                                                                                                                                        MD5

                                                                                                                                        31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                        SHA1

                                                                                                                                        ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                        SHA256

                                                                                                                                        222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                        SHA512

                                                                                                                                        53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

                                                                                                                                        Filesize

                                                                                                                                        460KB

                                                                                                                                        MD5

                                                                                                                                        b22521fb370921bb5d69bf8deecce59e

                                                                                                                                        SHA1

                                                                                                                                        3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

                                                                                                                                        SHA256

                                                                                                                                        b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

                                                                                                                                        SHA512

                                                                                                                                        1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

                                                                                                                                        Filesize

                                                                                                                                        418KB

                                                                                                                                        MD5

                                                                                                                                        0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                        SHA1

                                                                                                                                        0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                        SHA256

                                                                                                                                        919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                        SHA512

                                                                                                                                        5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        MD5

                                                                                                                                        8510bcf5bc264c70180abe78298e4d5b

                                                                                                                                        SHA1

                                                                                                                                        2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                                                        SHA256

                                                                                                                                        096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                                                        SHA512

                                                                                                                                        5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

                                                                                                                                        Filesize

                                                                                                                                        158KB

                                                                                                                                        MD5

                                                                                                                                        586f7fecacd49adab650fae36e2db994

                                                                                                                                        SHA1

                                                                                                                                        35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                        SHA256

                                                                                                                                        cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                        SHA512

                                                                                                                                        a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe

                                                                                                                                        Filesize

                                                                                                                                        451KB

                                                                                                                                        MD5

                                                                                                                                        c58df82b7146e046d56980fed1a9f4be

                                                                                                                                        SHA1

                                                                                                                                        a9c2a18f46a39dd6dcb7d61106ffedd4861f10b1

                                                                                                                                        SHA256

                                                                                                                                        47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29

                                                                                                                                        SHA512

                                                                                                                                        21c9dbec7cfe63076b4c279574ade07c0ecfac6670edeae79bedf6a1b1cf2d4f396b3fef64233cc1b6cb14864930ab063081c398db0aba19f66b54778460b3af

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe

                                                                                                                                        Filesize

                                                                                                                                        307KB

                                                                                                                                        MD5

                                                                                                                                        cf3c1c8bf8cb2a7c77f976c30bb1db06

                                                                                                                                        SHA1

                                                                                                                                        96660806f005a84bdac81a649a3118ac0f9605fc

                                                                                                                                        SHA256

                                                                                                                                        beb0d0b717d39474cdc522eea925e437dc02c260626b43db1d235640a5d568e0

                                                                                                                                        SHA512

                                                                                                                                        2fd14931d640159ffadc236482e8d36b5b16663b935d7bef273c149ddfd008fb9a5c280a2992a1b2f5c294ed4ce3e15101d7b7a9e05a5095b1362920033819a4

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe

                                                                                                                                        Filesize

                                                                                                                                        4.2MB

                                                                                                                                        MD5

                                                                                                                                        526a80021b8cf879a2da407a03fc250b

                                                                                                                                        SHA1

                                                                                                                                        33cfb8bae831bdb61e2062579a1df47d8057e522

                                                                                                                                        SHA256

                                                                                                                                        f4c2c862e6a7d85626a89defbfa1fbe1b392ab2361839d115817249cf597abaf

                                                                                                                                        SHA512

                                                                                                                                        9ba25ec0dd2455ee8ac22313b696f5fcd20aee8016d9be4f12c660d8583e08d4740328bb137575aaa5d402f89b19142eda8f3d2e1c6410967841aabee614fb61

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe

                                                                                                                                        Filesize

                                                                                                                                        386KB

                                                                                                                                        MD5

                                                                                                                                        0c4043a9a9efff20810530fd0cad91d7

                                                                                                                                        SHA1

                                                                                                                                        ca3adc7e4f1a027a2969749ccd5e2c1b06b88162

                                                                                                                                        SHA256

                                                                                                                                        1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc

                                                                                                                                        SHA512

                                                                                                                                        e5cb239c051ad141a56ca464be8068cebdc58029e39bc2d31495b27a5267604748f590397c2269d01b42f07af5a8840c8d3b339f4f042db165bd9c023a332d17

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe

                                                                                                                                        Filesize

                                                                                                                                        50KB

                                                                                                                                        MD5

                                                                                                                                        17eefbaaa30123fa3091add80026aed4

                                                                                                                                        SHA1

                                                                                                                                        8e43d736ea03bd33de5434bda5e20aae121cd218

                                                                                                                                        SHA256

                                                                                                                                        b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5

                                                                                                                                        SHA512

                                                                                                                                        e82fbbbfef61773fae1ed3e0767efa225ede0327ca5654de25e86359f4366942f85cf5542e67a52b24bb129d7fccf09fc68c64a73cf9269a75040d888005fa09

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                        MD5

                                                                                                                                        93338c2f6145798dfafcee30c199e20f

                                                                                                                                        SHA1

                                                                                                                                        5b7d99b4c1d83ff9ee31bc4c548c32b80f976597

                                                                                                                                        SHA256

                                                                                                                                        951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787

                                                                                                                                        SHA512

                                                                                                                                        b9596186abd820f85c2e72a6354bea9ab323ed75f4bfd7a815e8afebc5e25611e246948d7ed22bac934a114c9a309defeff149747751195ca98db24846e735cf

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6a73b935

                                                                                                                                        Filesize

                                                                                                                                        1.4MB

                                                                                                                                        MD5

                                                                                                                                        9943c31a8e47a82fc38223b2dce2e136

                                                                                                                                        SHA1

                                                                                                                                        c03db738061b02ab8efa5a50695979b61eb3094f

                                                                                                                                        SHA256

                                                                                                                                        597b3419233a9a15c733aba182afa700fde292448494eb97196dafd240770660

                                                                                                                                        SHA512

                                                                                                                                        7bf57311506e9b8e22d82e3c004215c2f7519687c2b82c253e3483683183112cd9999fb535715bca15f8d33c3acf6f320c09198eb8153fb5f520546e29d2e257

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404281829528034036.dll

                                                                                                                                        Filesize

                                                                                                                                        4.6MB

                                                                                                                                        MD5

                                                                                                                                        45fe60d943ad11601067bc2840cc01be

                                                                                                                                        SHA1

                                                                                                                                        911d70a6aad7c10b52789c0312c5528556a2d609

                                                                                                                                        SHA256

                                                                                                                                        0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

                                                                                                                                        SHA512

                                                                                                                                        30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Tmp6A88.tmp

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                        SHA1

                                                                                                                                        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                        SHA256

                                                                                                                                        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                        SHA512

                                                                                                                                        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_Files_\SelectRedo.docx

                                                                                                                                        Filesize

                                                                                                                                        127KB

                                                                                                                                        MD5

                                                                                                                                        7047cd38d07594a482b95d3f13a61618

                                                                                                                                        SHA1

                                                                                                                                        79f52e321e3d3db33cff86b6c4b840208b08d6a0

                                                                                                                                        SHA256

                                                                                                                                        ba02ba78047d1060c1ffc72c12c002a2b24560fa2a653c4db9b1adf68b2a6c9c

                                                                                                                                        SHA512

                                                                                                                                        e9fb2bd85c620feec02cac04d07cf4b44f28e431648e96642cd14bd05cb50e3634c00702ec029524592fa9716f15ab6e8a111299fbdcaaca4a7fa9848211e4cf

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_Files_\UninstallDismount.txt

                                                                                                                                        Filesize

                                                                                                                                        199KB

                                                                                                                                        MD5

                                                                                                                                        07b08481c0e6de4b12c30d644542cf91

                                                                                                                                        SHA1

                                                                                                                                        24b98c115fe60b45d92d6533b66263ce1b42f7e9

                                                                                                                                        SHA256

                                                                                                                                        6375bcb04f07f26243ac569fcdad9b29809ee7306e7f73b285804e99d84a9dda

                                                                                                                                        SHA512

                                                                                                                                        4229dc6cf40f0b726c0a97c526540feb25062f295f6eba66475078c16ab1b0091791590de9d0194144cd5704069e1edd06ee37ae31ebb1255b025116604b02f5

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjmynnei.t0o.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        7bb9636b237e4fd865d80e6f884d520e

                                                                                                                                        SHA1

                                                                                                                                        b8bb957bc01c787a5681286e483b25f496bdc2db

                                                                                                                                        SHA256

                                                                                                                                        7b0c4039557c2e8491f7e2eaf9d2ef668aa3dc7dc63fe145658b02ad59851ab5

                                                                                                                                        SHA512

                                                                                                                                        ced808098ce51716c83b62517a9f19999ce0155d000c42a6fbe1eb10e0aa89d23dd70f3f2d2e0fc9179bf662798a0151dd4c9897c1bdc9826645a4204095df25

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpD152.tmp

                                                                                                                                        Filesize

                                                                                                                                        46KB

                                                                                                                                        MD5

                                                                                                                                        02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                        SHA1

                                                                                                                                        84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                        SHA256

                                                                                                                                        522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                        SHA512

                                                                                                                                        60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpD6D6.tmp

                                                                                                                                        Filesize

                                                                                                                                        56KB

                                                                                                                                        MD5

                                                                                                                                        d444c807029c83b8a892ac0c4971f955

                                                                                                                                        SHA1

                                                                                                                                        fa58ce7588513519dc8fed939b26b05dc25e53b5

                                                                                                                                        SHA256

                                                                                                                                        8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

                                                                                                                                        SHA512

                                                                                                                                        b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpD737.tmp

                                                                                                                                        Filesize

                                                                                                                                        220KB

                                                                                                                                        MD5

                                                                                                                                        bf69aee53eb7e09784128e340390db21

                                                                                                                                        SHA1

                                                                                                                                        865c14f705ff90740cfca41125503f7b09d3b02d

                                                                                                                                        SHA256

                                                                                                                                        2e278ecc4627497ad3f5cb82afe333e221e36f464a06b9d0926583add3f5c4b3

                                                                                                                                        SHA512

                                                                                                                                        d6ee39f91cae3960aa6f2a251649eb6f7bf213539aaee8ea9c7db511cd2e35de1c62dab75f6e94eb6c48c45c0825fad0e0073e26204f1f2868e4dfffa44cfcc0

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.0.exe

                                                                                                                                        Filesize

                                                                                                                                        307KB

                                                                                                                                        MD5

                                                                                                                                        4c1211ca6acf41a9a2282c3291384bc5

                                                                                                                                        SHA1

                                                                                                                                        0d405a8e2c8df1621a10adf984c836e29f0a51c5

                                                                                                                                        SHA256

                                                                                                                                        52aa0c072e5c7fef19391a933cb34b085bf34d258d3fd7603a99907b262d547d

                                                                                                                                        SHA512

                                                                                                                                        1a7b194c8dba9f99ebb419a5ff2b0918f8ef6b44ee72f00953fd422e0028d9797181c7644e671013743fccea89abeb5e3306f32e94a0ecb4d5e90184cefbef2b

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.1.zip

                                                                                                                                        Filesize

                                                                                                                                        3.7MB

                                                                                                                                        MD5

                                                                                                                                        78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                        SHA1

                                                                                                                                        2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                        SHA256

                                                                                                                                        a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                        SHA512

                                                                                                                                        1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.2\UIxMarketPlugin.dll

                                                                                                                                        Filesize

                                                                                                                                        1.6MB

                                                                                                                                        MD5

                                                                                                                                        d1ba9412e78bfc98074c5d724a1a87d6

                                                                                                                                        SHA1

                                                                                                                                        0572f98d78fb0b366b5a086c2a74cc68b771d368

                                                                                                                                        SHA256

                                                                                                                                        cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

                                                                                                                                        SHA512

                                                                                                                                        8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.2\bunch.dat

                                                                                                                                        Filesize

                                                                                                                                        1.3MB

                                                                                                                                        MD5

                                                                                                                                        1e8237d3028ab52821d69099e0954f97

                                                                                                                                        SHA1

                                                                                                                                        30a6ae353adda0c471c6ed5b7a2458b07185abf2

                                                                                                                                        SHA256

                                                                                                                                        9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742

                                                                                                                                        SHA512

                                                                                                                                        a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.2\relay.dll

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                        MD5

                                                                                                                                        10d51becd0bbce0fab147ff9658c565e

                                                                                                                                        SHA1

                                                                                                                                        4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                                                        SHA256

                                                                                                                                        7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                                                        SHA512

                                                                                                                                        29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe

                                                                                                                                        Filesize

                                                                                                                                        2.4MB

                                                                                                                                        MD5

                                                                                                                                        9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                        SHA1

                                                                                                                                        fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                        SHA256

                                                                                                                                        a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                        SHA512

                                                                                                                                        140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.2\whale.dbf

                                                                                                                                        Filesize

                                                                                                                                        85KB

                                                                                                                                        MD5

                                                                                                                                        a723bf46048e0bfb15b8d77d7a648c3e

                                                                                                                                        SHA1

                                                                                                                                        8952d3c34e9341e4425571e10f22b782695bb915

                                                                                                                                        SHA256

                                                                                                                                        b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422

                                                                                                                                        SHA512

                                                                                                                                        ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u44o.3.exe

                                                                                                                                        Filesize

                                                                                                                                        4.6MB

                                                                                                                                        MD5

                                                                                                                                        397926927bca55be4a77839b1c44de6e

                                                                                                                                        SHA1

                                                                                                                                        e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                        SHA256

                                                                                                                                        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                        SHA512

                                                                                                                                        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        eb637d66c34aa57fd3cb7cbc686b3767

                                                                                                                                        SHA1

                                                                                                                                        4b3a1d127199e763ce145e3ad67cdd727d5f2beb

                                                                                                                                        SHA256

                                                                                                                                        72a6773436cf9f37cbb520a16584d8dd4cdf9266a63faa2d316abe19411bfa81

                                                                                                                                        SHA512

                                                                                                                                        535671fdcb4a299d7c3c1fc3b894fa0a4b4670cba85f7c26b38421ac2f9de35855bbdd8b2beada3ad6b7178383c78b583f15a617e4a0c83684d6f9b1fd04c376

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                                                                                                                                        Filesize

                                                                                                                                        109KB

                                                                                                                                        MD5

                                                                                                                                        154c3f1334dd435f562672f2664fea6b

                                                                                                                                        SHA1

                                                                                                                                        51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                                                                        SHA256

                                                                                                                                        5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                                                                        SHA512

                                                                                                                                        1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                                                                                                                        Filesize

                                                                                                                                        1.2MB

                                                                                                                                        MD5

                                                                                                                                        f35b671fda2603ec30ace10946f11a90

                                                                                                                                        SHA1

                                                                                                                                        059ad6b06559d4db581b1879e709f32f80850872

                                                                                                                                        SHA256

                                                                                                                                        83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                                                                        SHA512

                                                                                                                                        b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                        MD5

                                                                                                                                        0c582da789c91878ab2f1b12d7461496

                                                                                                                                        SHA1

                                                                                                                                        238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                                                        SHA256

                                                                                                                                        a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                                                        SHA512

                                                                                                                                        a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

                                                                                                                                        Filesize

                                                                                                                                        750KB

                                                                                                                                        MD5

                                                                                                                                        20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                                                        SHA1

                                                                                                                                        87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                                                        SHA256

                                                                                                                                        daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                                                        SHA512

                                                                                                                                        db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                                                      • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        3db38f0159a109798b7b715ccd4cf126

                                                                                                                                        SHA1

                                                                                                                                        466c60a7778f56a0552f8f677d05187994552857

                                                                                                                                        SHA256

                                                                                                                                        02b4aaa94a664303f66543b89d7f5c1dd78946a4d2bbdf696917165db8030690

                                                                                                                                        SHA512

                                                                                                                                        b74516e722a2073aa38f77d7117b0baa813073b89015c72bb59d1e10603a7f1fb8a9eabc8970fc7d2eb33582335ccb8f7f7bb1b0b71db3833264944fdd025292

                                                                                                                                      • C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe

                                                                                                                                        Filesize

                                                                                                                                        5.6MB

                                                                                                                                        MD5

                                                                                                                                        40e24b56642185d3b45d17f44d3a256a

                                                                                                                                        SHA1

                                                                                                                                        0ef796ac02581ccfcd3c7ae44af693a200d8b12e

                                                                                                                                        SHA256

                                                                                                                                        22ff278aa3fe118f203d791f4a99b54dd5b9f09ccf2895528e90f199d470b435

                                                                                                                                        SHA512

                                                                                                                                        c54fbeb1bbc1f7b4a09172934d4a755de84cd55ab152e1b77f2af63a516651b0f2bf44b1a4125e52fb63973e08198c82b8e94965ac22902f06d07a7ade50c567

                                                                                                                                      • C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe

                                                                                                                                        Filesize

                                                                                                                                        6.3MB

                                                                                                                                        MD5

                                                                                                                                        a63018cc078f57c640ac2ec8ed84dead

                                                                                                                                        SHA1

                                                                                                                                        1f5c17894a755114527e92304f4a74195c48031d

                                                                                                                                        SHA256

                                                                                                                                        41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558

                                                                                                                                        SHA512

                                                                                                                                        a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

                                                                                                                                      • C:\Users\Admin\Pictures\bBagzt3er9USMZej76KKEGAN.exe

                                                                                                                                        Filesize

                                                                                                                                        7KB

                                                                                                                                        MD5

                                                                                                                                        5b423612b36cde7f2745455c5dd82577

                                                                                                                                        SHA1

                                                                                                                                        0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                        SHA256

                                                                                                                                        e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                        SHA512

                                                                                                                                        c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                      • C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe

                                                                                                                                        Filesize

                                                                                                                                        4.2MB

                                                                                                                                        MD5

                                                                                                                                        cb2b161bbed4739c90366ddd0419a84e

                                                                                                                                        SHA1

                                                                                                                                        01cf657f15a61959de97d7477044bb3988c033a5

                                                                                                                                        SHA256

                                                                                                                                        e77265234679dcaa6987f921a87c9209773dd7f57181e0020bd147a7fde06e6c

                                                                                                                                        SHA512

                                                                                                                                        9cf64201b610f7c2032ecccc4919c7c0748c89b198751daff7ebfa1bd929041fa7a08adae5d9c7d917332da4aad179a23f99065eac67fc2fc7c220ebc251b5fb

                                                                                                                                      • C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe

                                                                                                                                        Filesize

                                                                                                                                        5.1MB

                                                                                                                                        MD5

                                                                                                                                        7ad0ae82b83b3a170044102d5a6232e5

                                                                                                                                        SHA1

                                                                                                                                        35163a1fbca5002d796322a0abae7872a83e2d99

                                                                                                                                        SHA256

                                                                                                                                        595cd83bdf4e6c74ca0c53121a902a667168dc236b865af3cb4b868e2d971455

                                                                                                                                        SHA512

                                                                                                                                        e31b328a59fc760e5d66d357fedc056a22596e38e72a0d596c17807711cdd789d6e59e866e3f510d7a5776638b0703cf55c015cfbbfec303c26ce523f052d309

                                                                                                                                      • C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe

                                                                                                                                        Filesize

                                                                                                                                        451KB

                                                                                                                                        MD5

                                                                                                                                        209baf341efd2d94d4a0158294c04d02

                                                                                                                                        SHA1

                                                                                                                                        3cfc11e2fd0a262ffad1359f7b127b9e74efd90c

                                                                                                                                        SHA256

                                                                                                                                        04043ec3c8c32b4b61ded42edb10fde3953690570505346e8c355946b2219574

                                                                                                                                        SHA512

                                                                                                                                        a57aa8d108c553011b7afa105f109954e52381f4b7997a2e57e4b36a2fdbcbbf4b16026e58e1022d83c34c0e75daff36c4c19d9baf8daad025b199b89e8500b2

                                                                                                                                      • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                        Filesize

                                                                                                                                        127B

                                                                                                                                        MD5

                                                                                                                                        8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                        SHA1

                                                                                                                                        a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                        SHA256

                                                                                                                                        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                        SHA512

                                                                                                                                        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                      • memory/872-194-0x0000000000A80000-0x0000000000AAE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        184KB

                                                                                                                                      • memory/1588-894-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.9MB

                                                                                                                                      • memory/1588-850-0x0000000000B40000-0x00000000011B4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.5MB

                                                                                                                                      • memory/1620-421-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/1644-562-0x000000006BD60000-0x000000006BEDB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                      • memory/1644-486-0x000000006BD60000-0x000000006BEDB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                      • memory/1644-487-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/1660-797-0x0000000000400000-0x0000000001A18000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.1MB

                                                                                                                                      • memory/1972-51-0x0000000000C50000-0x0000000000CA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        328KB

                                                                                                                                      • memory/1972-73-0x0000000003160000-0x0000000005160000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32.0MB

                                                                                                                                      • memory/1972-166-0x0000000073420000-0x0000000073BD0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/1972-50-0x0000000073420000-0x0000000073BD0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/2392-844-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/2392-779-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/2428-847-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/2428-787-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/2512-210-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.2MB

                                                                                                                                      • memory/2512-208-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.2MB

                                                                                                                                      • memory/2720-805-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/2720-804-0x000000006BD60000-0x000000006BEDB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                      • memory/2720-886-0x000000006BD60000-0x000000006BEDB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                      • memory/2812-156-0x00000000001B0000-0x0000000000202000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        328KB

                                                                                                                                      • memory/2812-864-0x0000000006700000-0x0000000006750000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        320KB

                                                                                                                                      • memory/3120-910-0x0000000002490000-0x00000000024C6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                      • memory/3196-382-0x0000000003260000-0x0000000003276000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        88KB

                                                                                                                                      • memory/3236-843-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/3236-623-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/3236-777-0x0000000000400000-0x0000000001DFB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        26.0MB

                                                                                                                                      • memory/3304-385-0x0000000000400000-0x0000000001A18000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.1MB

                                                                                                                                      • memory/3812-10-0x0000000000E80000-0x0000000001344000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/3812-8-0x0000000005940000-0x0000000005941000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-17-0x0000000000E80000-0x0000000001344000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/3812-1-0x0000000077814000-0x0000000077816000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                      • memory/3812-2-0x0000000000E80000-0x0000000001344000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/3812-11-0x00000000059C0000-0x00000000059C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-9-0x0000000005990000-0x0000000005991000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-7-0x0000000005930000-0x0000000005931000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-6-0x00000000059A0000-0x00000000059A1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-0-0x0000000000E80000-0x0000000001344000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/3812-12-0x00000000059B0000-0x00000000059B1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-5-0x0000000005950000-0x0000000005951000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-3-0x0000000005960000-0x0000000005961000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3812-4-0x0000000005970000-0x0000000005971000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4092-403-0x000000001C4C0000-0x000000001C4FC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        240KB

                                                                                                                                      • memory/4092-402-0x000000001B830000-0x000000001B842000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                      • memory/4092-619-0x000000001EA80000-0x000000001EC42000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.8MB

                                                                                                                                      • memory/4092-401-0x000000001DDF0000-0x000000001DEFA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.0MB

                                                                                                                                      • memory/4092-135-0x0000000000910000-0x00000000009D0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        768KB

                                                                                                                                      • memory/4092-515-0x000000001E300000-0x000000001E376000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        472KB

                                                                                                                                      • memory/4092-620-0x000000001F180000-0x000000001F6A8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.2MB

                                                                                                                                      • memory/4092-536-0x000000001C480000-0x000000001C49E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                      • memory/4188-76-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.6MB

                                                                                                                                      • memory/4424-625-0x0000000000400000-0x0000000001A3C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.2MB

                                                                                                                                      • memory/4424-803-0x0000000000400000-0x0000000001A3C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.2MB

                                                                                                                                      • memory/4424-904-0x0000000000400000-0x0000000001A3C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.2MB

                                                                                                                                      • memory/4588-622-0x0000000000400000-0x0000000001A18000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.1MB

                                                                                                                                      • memory/4892-362-0x0000028EEBCF0000-0x0000028EEBD4E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        376KB

                                                                                                                                      • memory/4892-270-0x0000028EEA0C0000-0x0000028EEA0CA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                      • memory/4892-361-0x0000028EEBC30000-0x0000028EEBC3A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                      • memory/5164-95-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        312KB

                                                                                                                                      • memory/5164-96-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        312KB

                                                                                                                                      • memory/5188-30-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-25-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-504-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-20-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-621-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-28-0x0000000004A40000-0x0000000004A41000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-27-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-26-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-306-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-842-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-24-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-23-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-22-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-29-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5188-21-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-848-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5188-776-0x0000000000B30000-0x0000000000FF4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.8MB

                                                                                                                                      • memory/5220-596-0x00000161F1C90000-0x00000161F1CA2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                      • memory/5220-368-0x00000161EF880000-0x00000161EF8A2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/5220-597-0x00000161F1C70000-0x00000161F1C7A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                      • memory/5312-311-0x0000000007130000-0x000000000717C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/5312-305-0x0000000006F60000-0x0000000006F72000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                      • memory/5312-127-0x0000000000EF0000-0x0000000000F42000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        328KB

                                                                                                                                      • memory/5312-133-0x0000000005DF0000-0x0000000006394000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.6MB

                                                                                                                                      • memory/5312-514-0x0000000007270000-0x00000000072D6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                      • memory/5312-307-0x0000000006FC0000-0x0000000006FFC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        240KB

                                                                                                                                      • memory/5312-304-0x0000000007020000-0x000000000712A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.0MB

                                                                                                                                      • memory/5312-147-0x0000000005840000-0x00000000058D2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        584KB

                                                                                                                                      • memory/5312-167-0x0000000005810000-0x000000000581A000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                      • memory/5312-267-0x00000000064A0000-0x0000000006516000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        472KB

                                                                                                                                      • memory/5312-288-0x0000000006D50000-0x0000000006D6E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                      • memory/5312-298-0x00000000074D0000-0x0000000007AE8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.1MB

                                                                                                                                      • memory/5352-505-0x0000000000400000-0x0000000001A3C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        22.2MB

                                                                                                                                      • memory/5384-802-0x0000000140000000-0x0000000140749000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.3MB

                                                                                                                                      • memory/5428-907-0x000000006BD60000-0x000000006BEDB000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1.5MB

                                                                                                                                      • memory/5428-595-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/5628-624-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                      • memory/5696-893-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/5796-63-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/5796-75-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/5796-72-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/5856-889-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4.7MB

                                                                                                                                      • memory/6124-344-0x0000000000B40000-0x0000000000B52000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        72KB