Analysis
-
max time kernel
53s -
max time network
6s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 09:05
Static task
static1
Behavioral task
behavioral1
Sample
IDHSBC0F23255675-T01.PDF.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
IDHSBC0F23255675-T01.PDF.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
IDHSBC0F23255675-T01.PDF.exe
-
Size
1.5MB
-
MD5
e1850574cfa39379efbe226004caca99
-
SHA1
4d34f1871db05909f7e48faec720acca9b67779d
-
SHA256
ecc34691e3df1c4c6fc2588efc33007d8c91ef155590280a9f022797ce571014
-
SHA512
6ea4c3d5652d56d53b9cd280be1b9ee3b5d743cccd84944df7e04d59df1e94225de166876fee27e51b1c12c7ee46ae2895e1573357d9bde42b1f647432ca429b
Score
7/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exedescription pid process Token: SeDebugPrivilege 1156 IDHSBC0F23255675-T01.PDF.exe -
Drops startup file 1 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk IDHSBC0F23255675-T01.PDF.exe -
Loads dropped DLL 84 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exepid process 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe 1448 IDHSBC0F23255675-T01.PDF.exe -
Drops file in Program Files directory 393 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exedescription ioc process File created C:\Program Files\7-Zip\v7zG.ico IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\EQUATION\vEQNEDT32.EXE IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\vOarpmany.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vxjc.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\7-Zip\v7zG.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\7-Zip\Uninstall.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\DW\RCX7937.tmp IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\vklist.ico IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\DW\vDWTRIG20.EXE IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPREARM.EXE IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vjinfo.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjinfo.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vnative2ascii.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\7-Zip\RCX7898.tmp IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vextcheck.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vnative2ascii.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vpack200.ico IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vjvisualvm.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vrmiregistry.ico IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\vserialver.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\7-Zip\7zG.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\EQUATION\RCX79B5.tmp IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\Smart Tag\vSmartTagInstall.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vappletviewer.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vpolicytool.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0 IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCX8085.tmp IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\vxjc.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\7-Zip\vUninstall.ico IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe IDHSBC0F23255675-T01.PDF.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe IDHSBC0F23255675-T01.PDF.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe IDHSBC0F23255675-T01.PDF.exe -
Drops file in Windows directory 1 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exedescription ioc process File opened for modification C:\Windows\bfsvc.exe IDHSBC0F23255675-T01.PDF.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exepid process 1156 IDHSBC0F23255675-T01.PDF.exe 1156 IDHSBC0F23255675-T01.PDF.exe 1156 IDHSBC0F23255675-T01.PDF.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exedescription pid process target process PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe PID 1156 wrote to memory of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
IDHSBC0F23255675-T01.PDF.exedescription pid process target process PID 1156 set thread context of 1448 1156 IDHSBC0F23255675-T01.PDF.exe IDHSBC0F23255675-T01.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDHSBC0F23255675-T01.PDF.exe"C:\Users\Admin\AppData\Local\Temp\IDHSBC0F23255675-T01.PDF.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\IDHSBC0F23255675-T01.PDF.exe"C:\Users\Admin\AppData\Local\Temp\IDHSBC0F23255675-T01.PDF.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Program Files\7-Zip\v7z.exe
-
\Program Files\7-Zip\v7zFM.exe
-
\Program Files\7-Zip\v7zG.exe
-
\Program Files\7-Zip\vUninstall.exe
-
\Program Files\Common Files\Microsoft Shared\DW\vDW20.EXE
-
\Program Files\Common Files\Microsoft Shared\DW\vDWTRIG20.EXE
-
\Program Files\Common Files\Microsoft Shared\EQUATION\vEQNEDT32.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\vODeploy.exe
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\vSetup.exe
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vFLTLDR.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vLICLUA.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOICONS.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOXMLED.EXE
-
\Program Files\Common Files\Microsoft Shared\OFFICE14\vOarpmany.exe
-
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPREARM.EXE
-
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\vOSPPSVC.EXE
-
\Program Files\Common Files\Microsoft Shared\Smart Tag\vSmartTagInstall.exe
-
\Program Files\Common Files\Microsoft Shared\Source Engine\vOSE.EXE
-
\Program Files\Java\jdk1.7.0_80\bin\vappletviewer.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vapt.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vextcheck.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vidlj.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjabswitch.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjar.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjarsigner.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjava-rmi.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjava.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavac.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavadoc.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavafxpackager.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavah.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavap.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavaw.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjavaws.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjcmd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjconsole.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjdb.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjhat.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjinfo.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjmap.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjmc.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjps.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjrunscript.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjsadebugd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjstack.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjstat.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjstatd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vjvisualvm.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vkeytool.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vkinit.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vklist.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vktab.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vnative2ascii.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vorbd.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vpack200.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vpolicytool.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vrmic.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vrmid.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vrmiregistry.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vschemagen.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vserialver.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vservertool.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vtnameserv.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vunpack200.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vwsgen.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vwsimport.exe
-
\Program Files\Java\jdk1.7.0_80\bin\vxjc.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjabswitch.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjava-rmi.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjava.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjavacpl.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjavaw.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjavaws.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vjp2launcher.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vkeytool.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vkinit.exe
-
\Program Files\Java\jdk1.7.0_80\jre\bin\vklist.exe
-
\Program Files\Java\jdk1.7.0_80\jre\lib\vlauncher.exe
-
\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\vnbexec.exe
-
\Program Files\Java\jre7\bin\vjabswitch.exe
-
\Program Files\Microsoft Office\Office14\vACCICONS.EXE
-
\Program Files\Mozilla Firefox\vcrashreporter.exe
-
\Program Files\VideoLAN\VLC\vuninstall.exe
-
\Users\Admin\AppData\Roaming\Paint.exe
-
memory/1156-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1448-3-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/1448-4-0x00000000004ABCA0-mapping.dmp
-
memory/1448-5-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB