adwind | 85b509c3352dde65b7dbd7c56207e2bcfe8245bf851132cbd61b93f4343077fc

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7
submitted
29-06-2020 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG-29062020.jar
Size

608KB
MD5

e2fdebfb3346325ae26240e1c2e0319b
SHA1

e2731770f57600dd347759523db864cf8fd68e7a
SHA256

85b509c3352dde65b7dbd7c56207e2bcfe8245bf851132cbd61b93f4343077fc
SHA512

4e0f30e6f8adb8b3fd7d1af9120907884d3447e1a6b41d8fac9d6fb5ad8b5e90a223474bda641f64a3f2cfecba06229e562b37e12a2f310d2d09db07a39475d7

Score

10^/10

trojan adwind persistence

Malware Config

Signatures

Loads dropped DLL 31 IoCs

Processes:

javaw.exejavaw.exejava.exe

pid	process
1512	javaw.exe
1512	javaw.exe
1512	javaw.exe
868
868
1648	javaw.exe
1648	javaw.exe
1648	javaw.exe
1648	javaw.exe
1648	javaw.exe
1648	javaw.exe
1648	javaw.exe
1648	javaw.exe
868
868
1432	java.exe
1432	java.exe
1432	java.exe
1432	java.exe
1432	java.exe
1648	javaw.exe
1648	javaw.exe
1432	java.exe
1432	java.exe
1432	java.exe
1432	java.exe
1648	javaw.exe
1432	java.exe
1432	java.exe
1648	javaw.exe
1648	javaw.exe

Executes dropped EXE 2 IoCs

Processes:

javaw.exejava.exe

pid process

1648 javaw.exe
1432 java.exe

pid	process
1648	javaw.exe
1432	java.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1584	WMIC.exe
Token: SeSecurityPrivilege	1584	WMIC.exe
Token: SeTakeOwnershipPrivilege	1584	WMIC.exe
Token: SeLoadDriverPrivilege	1584	WMIC.exe
Token: SeSystemProfilePrivilege	1584	WMIC.exe
Token: SeSystemtimePrivilege	1584	WMIC.exe
Token: SeProfSingleProcessPrivilege	1584	WMIC.exe
Token: SeIncBasePriorityPrivilege	1584	WMIC.exe
Token: SeCreatePagefilePrivilege	1584	WMIC.exe
Token: SeBackupPrivilege	1584	WMIC.exe
Token: SeRestorePrivilege	1584	WMIC.exe
Token: SeShutdownPrivilege	1584	WMIC.exe
Token: SeDebugPrivilege	1584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1584	WMIC.exe
Token: SeRemoteShutdownPrivilege	1584	WMIC.exe
Token: SeUndockPrivilege	1584	WMIC.exe
Token: SeManageVolumePrivilege	1584	WMIC.exe
Token: 33	1584	WMIC.exe
Token: 34	1584	WMIC.exe
Token: 35	1584	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1584	WMIC.exe
Token: SeSecurityPrivilege	1584	WMIC.exe
Token: SeTakeOwnershipPrivilege	1584	WMIC.exe
Token: SeLoadDriverPrivilege	1584	WMIC.exe
Token: SeSystemProfilePrivilege	1584	WMIC.exe
Token: SeSystemtimePrivilege	1584	WMIC.exe
Token: SeProfSingleProcessPrivilege	1584	WMIC.exe
Token: SeIncBasePriorityPrivilege	1584	WMIC.exe
Token: SeCreatePagefilePrivilege	1584	WMIC.exe
Token: SeBackupPrivilege	1584	WMIC.exe
Token: SeRestorePrivilege	1584	WMIC.exe
Token: SeShutdownPrivilege	1584	WMIC.exe
Token: SeDebugPrivilege	1584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1584	WMIC.exe
Token: SeRemoteShutdownPrivilege	1584	WMIC.exe
Token: SeUndockPrivilege	1584	WMIC.exe
Token: SeManageVolumePrivilege	1584	WMIC.exe
Token: 33	1584	WMIC.exe
Token: 34	1584	WMIC.exe
Token: 35	1584	WMIC.exe

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1496 reg.exe
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1124 attrib.exe
1692 attrib.exe

pid	process
1496	reg.exe

pid	process
1124	attrib.exe
1692	attrib.exe

Suspicious use of WriteProcessMemory 90 IoCs

Processes:

java.exewscript.exejavaw.exejava.execmd.execmd.execmd.execmd.exejavaw.execmd.exe

description	pid	process	target process
PID 1496 wrote to memory of 1124	1496	java.exe	wscript.exe
PID 1496 wrote to memory of 1124	1496	java.exe	wscript.exe
PID 1496 wrote to memory of 1124	1496	java.exe	wscript.exe
PID 1124 wrote to memory of 1512	1124	wscript.exe	javaw.exe
PID 1124 wrote to memory of 1512	1124	wscript.exe	javaw.exe
PID 1124 wrote to memory of 1512	1124	wscript.exe	javaw.exe
PID 1512 wrote to memory of 1860	1512	javaw.exe	java.exe
PID 1512 wrote to memory of 1860	1512	javaw.exe	java.exe
PID 1512 wrote to memory of 1860	1512	javaw.exe	java.exe
PID 1512 wrote to memory of 1932	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 1932	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 1932	1512	javaw.exe	cmd.exe
PID 1860 wrote to memory of 1644	1860	java.exe	cmd.exe
PID 1860 wrote to memory of 1644	1860	java.exe	cmd.exe
PID 1860 wrote to memory of 1644	1860	java.exe	cmd.exe
PID 1932 wrote to memory of 1580	1932	cmd.exe	cscript.exe
PID 1932 wrote to memory of 1580	1932	cmd.exe	cscript.exe
PID 1932 wrote to memory of 1580	1932	cmd.exe	cscript.exe
PID 1644 wrote to memory of 1652	1644	cmd.exe	cscript.exe
PID 1644 wrote to memory of 1652	1644	cmd.exe	cscript.exe
PID 1644 wrote to memory of 1652	1644	cmd.exe	cscript.exe
PID 1512 wrote to memory of 2028	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 2028	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 2028	1512	javaw.exe	cmd.exe
PID 1860 wrote to memory of 2016	1860	java.exe	cmd.exe
PID 1860 wrote to memory of 2016	1860	java.exe	cmd.exe
PID 1860 wrote to memory of 2016	1860	java.exe	cmd.exe
PID 2028 wrote to memory of 1412	2028	cmd.exe	cscript.exe
PID 2028 wrote to memory of 1412	2028	cmd.exe	cscript.exe
PID 2028 wrote to memory of 1412	2028	cmd.exe	cscript.exe
PID 2016 wrote to memory of 1308	2016	cmd.exe	cscript.exe
PID 2016 wrote to memory of 1308	2016	cmd.exe	cscript.exe
PID 2016 wrote to memory of 1308	2016	cmd.exe	cscript.exe
PID 1512 wrote to memory of 752	1512	javaw.exe	xcopy.exe
PID 1512 wrote to memory of 752	1512	javaw.exe	xcopy.exe
PID 1512 wrote to memory of 752	1512	javaw.exe	xcopy.exe
PID 1860 wrote to memory of 1608	1860	java.exe	xcopy.exe
PID 1860 wrote to memory of 1608	1860	java.exe	xcopy.exe
PID 1860 wrote to memory of 1608	1860	java.exe	xcopy.exe
PID 1512 wrote to memory of 1484	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 1484	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 1484	1512	javaw.exe	cmd.exe
PID 1512 wrote to memory of 1496	1512	javaw.exe	reg.exe
PID 1512 wrote to memory of 1496	1512	javaw.exe	reg.exe
PID 1512 wrote to memory of 1496	1512	javaw.exe	reg.exe
PID 1512 wrote to memory of 1124	1512	javaw.exe	attrib.exe
PID 1512 wrote to memory of 1124	1512	javaw.exe	attrib.exe
PID 1512 wrote to memory of 1124	1512	javaw.exe	attrib.exe
PID 1512 wrote to memory of 1692	1512	javaw.exe	attrib.exe
PID 1512 wrote to memory of 1692	1512	javaw.exe	attrib.exe
PID 1512 wrote to memory of 1692	1512	javaw.exe	attrib.exe
PID 1512 wrote to memory of 1648	1512	javaw.exe	javaw.exe
PID 1512 wrote to memory of 1648	1512	javaw.exe	javaw.exe
PID 1512 wrote to memory of 1648	1512	javaw.exe	javaw.exe
PID 1648 wrote to memory of 1432	1648	javaw.exe	java.exe
PID 1648 wrote to memory of 1432	1648	javaw.exe	java.exe
PID 1648 wrote to memory of 1432	1648	javaw.exe	java.exe
PID 1648 wrote to memory of 1540	1648	javaw.exe	cmd.exe
PID 1648 wrote to memory of 1540	1648	javaw.exe	cmd.exe
PID 1648 wrote to memory of 1540	1648	javaw.exe	cmd.exe
PID 1540 wrote to memory of 1944	1540	cmd.exe	cscript.exe
PID 1540 wrote to memory of 1944	1540	cmd.exe	cscript.exe
PID 1540 wrote to memory of 1944	1540	cmd.exe	cscript.exe
PID 1648 wrote to memory of 1840	1648	javaw.exe	cmd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

javaw.exejava.exejavaw.exejava.exe

pid process

1512 javaw.exe
1860 java.exe
1648 javaw.exe
1432 java.exe

Drops file in System32 directory 3 IoCs

Processes:

javaw.exejava.exejavaw.exe

description	ioc	process
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe
File created	C:\Windows\System32\test.txt	javaw.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\oLiRcQboziP = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\XtfbYFSllUG\\HSlpmBTQGBC.ckIzMd\""	reg.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\IMG-29062020.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\wscript.exe
wscript C:\Users\Admin\xdssilkvar.js
2⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\rmeus.txt"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
PID:1512

C:\Program Files\Java\jre7\bin\java.exe
"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.204081774803700824238728904040171294.class
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:1860

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5645672453198199077.vbs
5⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5645672453198199077.vbs
6⤵
PID:1652

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3446815263066391033.vbs
5⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3446815263066391033.vbs
6⤵
PID:1308

C:\Windows\system32\xcopy.exe
xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
5⤵
PID:1608

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6596511074867152415.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6596511074867152415.vbs
5⤵
PID:1580

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7844688570652582015.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7844688570652582015.vbs
5⤵
PID:1412

C:\Windows\system32\xcopy.exe
xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
4⤵
PID:752

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:1484

C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v oLiRcQboziP /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\XtfbYFSllUG\HSlpmBTQGBC.ckIzMd\"" /f
4⤵
- Modifies registry key
- Adds Run entry to start application
PID:1496

C:\Windows\system32\attrib.exe
attrib +h "C:\Users\Admin\XtfbYFSllUG\*.*"
4⤵
- Views/modifies file attributes
PID:1124

C:\Windows\system32\attrib.exe
attrib +h "C:\Users\Admin\XtfbYFSllUG"
4⤵
- Views/modifies file attributes
PID:1692

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\XtfbYFSllUG\HSlpmBTQGBC.ckIzMd
4⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
PID:1648

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.39214227785529443862500048043077720.class
5⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
PID:1432

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3347458029807411711.vbs
6⤵
PID:1548

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3347458029807411711.vbs
7⤵
PID:280

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3552676419193259699.vbs
6⤵
PID:468

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3552676419193259699.vbs
7⤵
PID:1816

C:\Windows\system32\cmd.exe
cmd.exe
6⤵
PID:1992

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7735739204227951184.vbs
5⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7735739204227951184.vbs
6⤵
PID:1944

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7300778619641369173.vbs
5⤵
PID:1840

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7300778619641369173.vbs
6⤵
PID:752

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:1964

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Retrive3347458029807411711.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive3446815263066391033.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive3552676419193259699.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive5645672453198199077.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive6596511074867152415.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive7300778619641369173.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive7735739204227951184.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive7844688570652582015.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.204081774803700824238728904040171294.class

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.39214227785529443862500048043077720.class

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1131729243-447456001-3632642222-1000\83aa4cc77f591dfc2374580bbd95f6ba_bae8c589-5da1-4c62-be46-f8d74908cb8c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\COPYRIGHT

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunmscapi.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunmscapi.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\net.properties

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\US_export_policy.jar

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\local_policy.jar

Download Submit
C:\Users\Admin\AppData\Roaming\rmeus.txt

Download Submit
C:\Users\Admin\XtfbYFSllUG\HSlpmBTQGBC.ckIzMd

Download Submit
C:\Users\Admin\XtfbYFSllUG\ID.txt

Download Submit
C:\Users\Admin\xdssilkvar.js

Download Submit
C:\Windows\System32\test.txt

Download Submit
C:\Windows\System32\test.txt

Download Submit
\Users\Admin\AppData\Local\Temp\Windows3159093458125071447.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\sunmscapi.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\sunmscapi.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Download Submit
\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Download Submit
memory/280-106-0x00000000024E0000-0x00000000024E4000-memory.dmp

Filesize
16KB

Download
memory/280-102-0x0000000000000000-mapping.dmp

Download
memory/468-107-0x0000000000000000-mapping.dmp

Download
memory/752-95-0x0000000000000000-mapping.dmp

Download
memory/752-98-0x00000000026B0000-0x00000000026B4000-memory.dmp

Filesize
16KB

Download
memory/752-27-0x0000000000000000-mapping.dmp

Download
memory/1124-5-0x00000000027B0000-0x00000000027B4000-memory.dmp

Filesize
16KB

Download
memory/1124-32-0x0000000000000000-mapping.dmp

Download
memory/1124-1-0x0000000000000000-mapping.dmp

Download
memory/1308-26-0x0000000002500000-0x0000000002504000-memory.dmp

Filesize
16KB

Download
memory/1308-22-0x0000000000000000-mapping.dmp

Download
memory/1412-25-0x0000000002410000-0x0000000002414000-memory.dmp

Filesize
16KB

Download
memory/1412-21-0x0000000000000000-mapping.dmp

Download
memory/1432-65-0x0000000000000000-mapping.dmp

Download
memory/1484-30-0x0000000000000000-mapping.dmp

Download
memory/1496-31-0x0000000000000000-mapping.dmp

Download
memory/1512-3-0x0000000000000000-mapping.dmp

Download
memory/1540-88-0x0000000000000000-mapping.dmp

Download
memory/1548-101-0x0000000000000000-mapping.dmp

Download
memory/1580-18-0x0000000002640000-0x0000000002644000-memory.dmp

Filesize
16KB

Download
memory/1580-13-0x0000000000000000-mapping.dmp

Download
memory/1584-120-0x0000000000000000-mapping.dmp

Download
memory/1608-28-0x0000000000000000-mapping.dmp

Download
memory/1644-12-0x0000000000000000-mapping.dmp

Download
memory/1648-40-0x0000000000000000-mapping.dmp

Download
memory/1652-17-0x0000000002600000-0x0000000002604000-memory.dmp

Filesize
16KB

Download
memory/1652-14-0x0000000000000000-mapping.dmp

Download
memory/1692-33-0x0000000000000000-mapping.dmp

Download
memory/1816-110-0x0000000002640000-0x0000000002644000-memory.dmp

Filesize
16KB

Download
memory/1816-108-0x0000000000000000-mapping.dmp

Download
memory/1840-93-0x0000000000000000-mapping.dmp

Download
memory/1860-7-0x0000000000000000-mapping.dmp

Download
memory/1932-11-0x0000000000000000-mapping.dmp

Download
memory/1944-89-0x0000000000000000-mapping.dmp

Download
memory/1944-92-0x0000000002470000-0x0000000002474000-memory.dmp

Filesize
16KB

Download
memory/1964-100-0x0000000000000000-mapping.dmp

Download
memory/1992-112-0x0000000000000000-mapping.dmp

Download
memory/2016-20-0x0000000000000000-mapping.dmp

Download
memory/2028-19-0x0000000000000000-mapping.dmp

Download