Analysis

  • user interaction
    yes
  • max time kernel
    104s
  • max time network
    107s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    08/08/2026, 23:11

General

  • Target
    terminal64.exe
  • Size 119.3MB
  • Sample260808-2579cazxct
  • SHA256 fe78fdc9d3e29c17e0949dcb0a9ea601f48f72b1c48f379bf6437b93681427ee
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\terminal64.exe
    "C:\Users\Admin\AppData\Local\Temp\terminal64.exe"
    1⤵
    • Checks BIOS information in registry
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\metaeditor64.exe
      C:\Users\Admin\AppData\Local\Temp\metaeditor64.exe /portable /compile:"C:\Users\Admin\AppData\Local\Temp\MQL5" /inc:"C:\Users\Admin\AppData\Local\Temp\MQL5" /time:0 /flg:0 /stop:se324_240662671
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1728
  • C:\Users\Admin\AppData\Local\Temp\terminal64.exe
    "C:\Users\Admin\AppData\Local\Temp\terminal64.exe"
    1⤵
    • Checks BIOS information in registry
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\metaeditor64.exe
      C:\Users\Admin\AppData\Local\Temp\metaeditor64.exe /portable /compile:"C:\Users\Admin\AppData\Local\Temp\MQL5" /inc:"C:\Users\Admin\AppData\Local\Temp\MQL5" /time:0 /flg:0 /stop:se2124_240708500
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2908
  • C:\Users\Admin\AppData\Local\Temp\terminal64.exe
    "C:\Users\Admin\AppData\Local\Temp\terminal64.exe"
    1⤵
    • Checks BIOS information in registry
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\metaeditor64.exe
      C:\Users\Admin\AppData\Local\Temp\metaeditor64.exe /portable /compile:"C:\Users\Admin\AppData\Local\Temp\MQL5" /inc:"C:\Users\Admin\AppData\Local\Temp\MQL5" /time:1786230927 /flg:0 /stop:se2304_240737796
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ExpertMACD.mq5

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Advisors\ExpertMACD.mq5
        • Size 5KB
        • SHA256 6e74d3e8e90324e5180ec717dc536530d2bcda7cee944b813626211e54b67820
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertMAMA.mq5

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Advisors\ExpertMAMA.mq5
        • Size 6KB
        • SHA256 9d99ed8320d56651ec8b75c41a07c336b58ac265f04598ad5dd2824bcd670e51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertMAPSAR.mq5

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Advisors\ExpertMAPSAR.mq5
        • Size 6KB
        • SHA256 6c5e7b665a766e6e995b673d9b8cd1e4c40e4de885c4413ad8f7e4b8a9a45e62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertMAPSARSizeOptimized.mq5

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Advisors\ExpertMAPSARSizeOptimized.mq5
        • Size 6KB
        • SHA256 7a85019ffe7063656f234629d10423dd4e1661857b787350964bdc0a4e8ae299
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChartInChart.mq5

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Examples\ChartInChart\ChartInChart.mq5
        • Size 18KB
        • SHA256 78e8158057476de21c60e32a54d0705aa5703a68ee696a5717d932e6faa29036
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Controls.mq5

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Examples\Controls\Controls.mq5
        • Size 2KB
        • SHA256 402a5c589f50a543dc914d1b4687ad4328ea4946beecc312e2ada807a382e457
        • MD5 SHA1 SHA512 TLSH

        ControlsDialog.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Experts\Examples\Controls\ControlsDialog.mqh
        • Size 17KB
        • SHA256 ebdc902f8f9b26d6112b04f9d0bc193f743b189d366110f74ad083d009733b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Array.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Arrays\Array.mqh
        • Size 6KB
        • SHA256 2945e251c682a6bfe000e530caf0df19cba544c29f4ae0dcc65850f08eb28b35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ArrayDatetime.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Arrays\ArrayDatetime.mqh
        • Size 24KB
        • SHA256 bf5a3583f4a845ca97e7ee5c6c394d2b942269882b69c6432abbf943ac36ba73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ArrayDouble.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Arrays\ArrayDouble.mqh
        • Size 24KB
        • SHA256 88206b8c69b75870b325f6c8ba16510400da344dfe3b8f91ac7ea0c29d86b4e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ArrayInt.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Arrays\ArrayInt.mqh
        • Size 24KB
        • SHA256 bd486d9be621c0d48704a17d04763eba691ad339606faec63ae339141de309de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ArrayLong.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Arrays\ArrayLong.mqh
        • Size 24KB
        • SHA256 7cb1150249e8ecda7eeed377df12a18571ddffb911dc4427dbbe735b84ca29e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ArrayObj.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Arrays\ArrayObj.mqh
        • Size 24KB
        • SHA256 d372820fcf77c782e54851c896dfe58c46b21fcfc478ddae39ecb42b76663c27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Canvas.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Canvas\Canvas.mqh
        • Size 152KB
        • SHA256 d4bd7c6916104ce6ceabd31fe119e1b283658d4c639ec8b62171a2805da84c48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChartObject.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\ChartObjects\ChartObject.mqh
        • Size 40KB
        • SHA256 bb93b69aa4e346da15bb0d60dbe9fd1a2e81c71187179d440bbbcd71e467c1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChartObjectsBmpControls.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\ChartObjects\ChartObjectsBmpControls.mqh
        • Size 20KB
        • SHA256 868e79c3743c4f41a9f7ba853a3e7a04498cdc8b1b88c59f141aeff96227e115
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChartObjectsTxtControls.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\ChartObjects\ChartObjectsTxtControls.mqh
        • Size 37KB
        • SHA256 261b1a92a84eafdba7cbc605b3eaccb4d8fa2a8a12bd2a9f389c5324e88c7842
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Chart.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Charts\Chart.mqh
        • Size 62KB
        • SHA256 b95980e797f2295711f63e7440a86e5808183dc2832be71cf9a24b33e4325262
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BmpButton.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\BmpButton.mqh
        • Size 11KB
        • SHA256 7760f436bba303abd5628ea6e1b406a5ccedeca9fd47888f210c7497983dd632
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Button.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Button.mqh
        • Size 6KB
        • SHA256 0dd1531e7ec012b7b842b02bef6a14722c68770f87f82950e1079f16cb697dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DateDropList.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\DateDropList.mqh
        • Size 14KB
        • SHA256 c6ebcef9c0335ccbc3abc67483140008017b5600189a0805264557c2a608d2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DatePicker.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\DatePicker.mqh
        • Size 10KB
        • SHA256 90d6d75f31800367edcf9f269c8a7da99d175ca8c78bd0fc7ebef586b03c4b14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Defines.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Defines.mqh
        • Size 12KB
        • SHA256 1d42290c37ed8fd9a9be8ba39cf19bcee233eec695abd3feebd7be0aa2341706
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Dialog.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Dialog.mqh
        • Size 37KB
        • SHA256 0e90103381318be89d7b9966775540daa6fcc0be3733baf3539288a077cc1fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Edit.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Edit.mqh
        • Size 8KB
        • SHA256 c75efd5dcf9a8c3423cda6eeab49c2fe0aa3f1d8ef84249f8450585b4e9955e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Panel.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Panel.mqh
        • Size 5KB
        • SHA256 0f3fcdbb04415ac8de2f9dd703d04f6363e605e22b46c74cbfe495f4a330beb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Picture.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Picture.mqh
        • Size 5KB
        • SHA256 e792ac271010c3ed998a7aa5ad81969df7a8b964969e9bec352fa78677980098
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Rect.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Rect.mqh
        • Size 10KB
        • SHA256 c6a94653554997665b86a3dde619ee5e2e04acf4fc0165abb1022ac858ab9f54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Scrolls.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Scrolls.mqh
        • Size 26KB
        • SHA256 9e25f574d19445db5e4baec1846f5e0e3f16acce85b2cf76e46f77575ff9c703
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Wnd.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\Wnd.mqh
        • Size 29KB
        • SHA256 186cd7db61713817e074c21d398cc1452ce3498c3763b13d6a6e91d4c1935646
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WndClient.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\WndClient.mqh
        • Size 11KB
        • SHA256 c0567d56284337d8f5fb9f14f96bfd8b0e3792503d4b87e5ab464841edaae642
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WndContainer.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\WndContainer.mqh
        • Size 15KB
        • SHA256 4231fbd351c1d05916b0f41e45712d573ef8931c63af34a8ac0b6811f13a1284
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WndObj.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Controls\WndObj.mqh
        • Size 10KB
        • SHA256 686a1917b056ea18d0847cdfd53c631ccb52a2e199fa754c84e8ddd79b8302fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Expert.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Expert.mqh
        • Size 59KB
        • SHA256 30b4e2492d8290027da3dd2de96440445575d0a781650a2b36c63dbe947d208c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertBase.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\ExpertBase.mqh
        • Size 26KB
        • SHA256 3c560e25f13e2b7cf747fd5901a0b96e43c8ddf2074894922b4f680d8e4ef7a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertMoney.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\ExpertMoney.mqh
        • Size 4KB
        • SHA256 4c66ae4baa7d80af3c99249a8bf3a4048ca6491e3ce28fe07a928418e8265bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertSignal.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\ExpertSignal.mqh
        • Size 19KB
        • SHA256 85749f071affa3ff9de1c415b41923494537eecd4d2f61d8a6ca377d6f1fc757
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertTrade.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\ExpertTrade.mqh
        • Size 6KB
        • SHA256 1d408461a19d5c0fb736fe67d84437d4a737ffcb23e439d2b78ef48e94c88e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpertTrailing.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\ExpertTrailing.mqh
        • Size 1KB
        • SHA256 e95e0fe031681decf912ce396bc2d8b22f1c9870ebec09538cac695c12b8344b
        • MD5 SHA1 SHA512 TLSH

        MoneyNone.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Money\MoneyNone.mqh
        • Size 3KB
        • SHA256 521fe840ebbd4edecd8c4b0ff9292eb62fdd4b3c550913a16e751b71a8e1fb4c
        • MD5 SHA1 SHA512 TLSH

        MoneySizeOptimized.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Money\MoneySizeOptimized.mqh
        • Size 6KB
        • SHA256 2113329dc000e2a134ac6d5d0aa9cd7f3e212739f00f79df7537d89775cb1bef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SignalMA.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Signal\SignalMA.mqh
        • Size 11KB
        • SHA256 e6f6ad95efe46f656cbcb8180d10d22e14c964309b8696e131c752391394c762
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SignalMACD.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Signal\SignalMACD.mqh
        • Size 19KB
        • SHA256 91b9cb77c8620d6c76f85629d854bc27ed38c6569caeabb73698111f61477a43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TrailingMA.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Trailing\TrailingMA.mqh
        • Size 6KB
        • SHA256 b30e686285235b5ba4a37ba8b4049ca8e12961055eb304c82722e71a1a38911f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TrailingNone.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Trailing\TrailingNone.mqh
        • Size 2KB
        • SHA256 75a79819f396fc05f07cf284ee9cd6d17663ecd1e6f8f4e616dbe243e7806f14
        • MD5 SHA1 SHA512 TLSH

        TrailingParabolicSAR.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Expert\Trailing\TrailingParabolicSAR.mqh
        • Size 5KB
        • SHA256 ae4e7b09534ca4df0d8df1a5dc9864fe718c45295a94b22094786edef1ed9e2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BillWilliams.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\BillWilliams.mqh
        • Size 32KB
        • SHA256 add9317316aa3b8af913e407e34c10968ec7a9b5e366df26bb470e8fe0e471f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Custom.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Custom.mqh
        • Size 7KB
        • SHA256 640dad8239615e70f5a34851ffa68d3d08add88c81084f8c47a8d1d2159712ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Indicator.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Indicator.mqh
        • Size 19KB
        • SHA256 7e13befcf5d2897c34d93dbf7b83b39256096caf80679400bd92c71a69ba3b26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Indicators.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Indicators.mqh
        • Size 11KB
        • SHA256 d097a0afab87d7d5e82e38fcafbcb682b7110667fdbcb82c83568744ee670e07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Oscilators.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Oscilators.mqh
        • Size 72KB
        • SHA256 55bbc72a57e0e56a115b230ea409d4072b6f4fdbb6f79e546bb954d2c8a691a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Series.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Series.mqh
        • Size 12KB
        • SHA256 1072582c768b2e5d777e0f8947e2089c7d35c0fe328234c3db32504bcdf764be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TimeSeries.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\TimeSeries.mqh
        • Size 61KB
        • SHA256 37ce77ff867ef971f5005affa522848eee2e5e5d6cb17dd40366c860af0e7ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Trend.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Trend.mqh
        • Size 72KB
        • SHA256 3d710bbfb1a7a7477e5a14b468d427a57f66cf3c4b31b01b92b1b99531197e55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Volumes.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Indicators\Volumes.mqh
        • Size 17KB
        • SHA256 ea6b8bd95aa9b7998e1e62255d50e24496fc179b690b4ac16fd07feac7dc75c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Object.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Object.mqh
        • Size 1KB
        • SHA256 dfad4fdb6d1bf47cf43fcbc2882e52979459f17a776f75f250a7c32d0623ab35
        • MD5 SHA1 SHA512 TLSH

        StdLibErr.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\StdLibErr.mqh
        • Size 683B
        • SHA256 04bb2c47b1b04dceb052e6dba1f85e0330c53abc602f341e2ea95ea1498ab28b
        • MD5 SHA1 SHA512 TLSH

        AccountInfo.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\AccountInfo.mqh
        • Size 17KB
        • SHA256 f0230a9df2866a09db226c4382a3b53c8c691cbdaef1c4656f41f035a4c8b31b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DealInfo.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\DealInfo.mqh
        • Size 15KB
        • SHA256 9d6fb4e7d8754eaee761e43943dc49cdc3a32793ee8438119d939ea7bad71880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        HistoryOrderInfo.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\HistoryOrderInfo.mqh
        • Size 19KB
        • SHA256 e88f6be450462a045470315887ef751a4510da65a5115325dc88542743fc52f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OrderInfo.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\OrderInfo.mqh
        • Size 21KB
        • SHA256 d0e479578ef91d2ef1b07ae63d28ae54e15cebb914dd10e5d4510c269a9ca999
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PositionInfo.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\PositionInfo.mqh
        • Size 15KB
        • SHA256 dd720b755c7f23dcc109fc81bcf0772b907411d545e4a1117421737bb9ff6897
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SymbolInfo.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\SymbolInfo.mqh
        • Size 35KB
        • SHA256 58d0eedd27ca11d93f4c81cab4c9fe0531fe2b844f871b54e200c32a3574c0e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Trade.mqh

        • Path C:\Users\Admin\AppData\Local\Temp\MQL5\Include\Trade\Trade.mqh
        • Size 67KB
        • SHA256 96e6781624534377fe7971cba52cca3d62d1b030bc10d5e4ebf3ed8c541399ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        assistant.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\assistant.ini
        • Size 1002B
        • SHA256 304af027848a9f2936027c622cf055ac878d5dbe33b71dc037d029fecb63d91c
        • MD5 SHA1 SHA512 TLSH

        common.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\common.ini
        • Size 590B
        • SHA256 f8a5b8a535d94015b99fcc27eb7ef5b641162bbd3bfb84ce35ed57488b8343c5
        • MD5 SHA1 SHA512 TLSH

        hotkeys.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\hotkeys.ini
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 16KB
        • SHA256 ae4b7b31e667fd6193b354d89d7e1609b6a37b648c946880ca0432102d26263c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 16KB
        • SHA256 0743a2b12589ea83b930e593ef006620ed14a6ec47ec4dfc5938522509712fd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 16KB
        • SHA256 7c2567c97a26769170a4a9bb1849a68010058dbd7e86294f6fc26728e92ee87f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 16KB
        • SHA256 2453a722b4b8b4fe7aec64401a7897e6763e9d11bf34659b4477a3b7d2f1a49b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 9KB
        • SHA256 a9b013c629cac9b80ac59d052d6ef2e1e426bf6ce340e7a66709e54b0c902312
        • MD5 SHA1 SHA512 SSDEEP TLSH

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 9KB
        • SHA256 cfe855a68ae136eaa972e00b238dc31a335a9b9aac0e9f1d479ff9e828f3da14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        terminal.ini

        • Path C:\Users\Admin\AppData\Local\Temp\config\terminal.ini
        • Size 9KB
        • SHA256 9e763c1fd9000996b49a6f5ab6433ef7d7d68596e23fa62125862de6cf592432
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5524DB37E1907A8F844698337C338AF7.png

        • Path C:\Users\Admin\AppData\Roaming\MetaQuotes\Terminal\Community\Labels\55\5524DB37E1907A8F844698337C338AF7.png
        • Size 2KB
        • SHA256 4b12b14bd5a928b7addf492e484c82fb5c11bfce63fc4bb4cbef6be7540ddfaa
        • MD5 SHA1 SHA512 TLSH

        memory/1728-750-0x00007FFAA1790000-0x00007FFAA1792000-memory.dmp

        memory/4572-0-0x00007FFAA1790000-0x00007FFAA1792000-memory.dmp