"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view.html

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe	N/A
N/A	N/A	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
N/A	N/A	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A

Checks for any installed AV software in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	drive.google.com	N/A	N/A
N/A	drive.google.com	N/A	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\McAfee\Temp4094822419\logicscripts.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\uimanager.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\wa-common.css	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-en-US.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-fi-FI.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-nb-NO.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-zh-TW.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\mfw-mwb.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-de-DE.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\dkjson.luc	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-pt-BR.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-tr-TR.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-hr-HR.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\resource.dll	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\mfw-nps.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-sk-SK.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-es-ES.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\analyticstelemetry.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\eventmanager.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\telemetry.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-it-IT.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-ru-RU.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\logic\ff_monitor.luc	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\uihost.exe	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\icon_complete.png	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\logger.luc	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\l10n.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\wa_install_check2.png	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-es-MX.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-nl-NL.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-hu-HU.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\installer.exe	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\wa-core.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-cs-CZ.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-hu-HU.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-pl-PL.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-cs-CZ.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-fr-FR.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\mwbhandler.luc	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\icon_failed.png	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\resource.dll	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-fi-FI.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-sk-SK.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-de-DE.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-it-IT.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-zh-TW.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\class.luc	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\analyticsmanager.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\wataskmanager.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-el-GR.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-zh-CN.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\taskmanager.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\wa-utils.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-da-DK.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-sr-Latn-CS.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-install-nb-NO.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\init.luc	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\browserplugin.cab	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\eula-en-US.txt	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-da-DK.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-ja-JP.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\jslang\wa-res-shared-sr-Latn-CS.js	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A
File created	C:\Program Files\McAfee\Temp4094822419\mcafee_pc_install_icon.png	C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe	N/A

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	C:\Windows\system32\taskmgr.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	C:\Windows\system32\taskmgr.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\system32\taskmgr.exe	N/A

Creates scheduled task(s)

persistence

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\schtasks.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133575717191298880"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe	N/A
N/A	N/A	C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe	N/A
N/A	N/A	C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe	N/A
N/A	N/A	C:\Program Files\McAfee\Temp4094822419\installer.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7ee0ab58,0x7ffe7ee0ab68,0x7ffe7ee0ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1064 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4268 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4436 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4508,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4808 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5632 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5648 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4652 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4636 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:8

C:\Users\Admin\Downloads\JDownloaderSetup.exe

"C:\Users\Admin\Downloads\JDownloaderSetup.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1656,i,2183451829298907055,16488826239448690002,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe

"C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe" -Dexecuteafter=false "-Dregistry=true" -DinstallationDir="C:\Users\Admin\AppData\Local\JDownloader 2.0" -q "-Dfilelinks=dlc,jdc,ccf,rsdf" "-Ddesktoplink=true" "-Dquicklaunch=false"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\charsets.jar.pack" "jre\lib\charsets.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\jce.jar.pack" "jre\lib\jce.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\jfr.jar.pack" "jre\lib\jfr.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\jsse.jar.pack" "jre\lib\jsse.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\management-agent.jar.pack" "jre\lib\management-agent.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\resources.jar.pack" "jre\lib\resources.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\rt.jar.pack" "jre\lib\rt.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\access-bridge-32.jar.pack" "jre\lib\ext\access-bridge-32.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\access-bridge.jar.pack" "jre\lib\ext\access-bridge.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\cldrdata.jar.pack" "jre\lib\ext\cldrdata.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\dnsns.jar.pack" "jre\lib\ext\dnsns.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\jaccess.jar.pack" "jre\lib\ext\jaccess.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\localedata.jar.pack" "jre\lib\ext\localedata.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\nashorn.jar.pack" "jre\lib\ext\nashorn.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\sunec.jar.pack" "jre\lib\ext\sunec.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\sunjce_provider.jar.pack" "jre\lib\ext\sunjce_provider.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\sunmscapi.jar.pack" "jre\lib\ext\sunmscapi.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\sunpkcs11.jar.pack" "jre\lib\ext\sunpkcs11.jar"

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

-r "jre\lib\ext\zipfs.jar.pack" "jre\lib\ext\zipfs.jar"

\??\c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe

"c:\users\admin\appdata\local\temp\E4J2DE~1.TMP\jre\bin\java.exe" -version

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe

"saBSI.exe" /affid 91212 PaidDistribution=true InstallID=a045d04d-6cbb-4e2b-8227-7d14531c588c subID=KC

C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe

"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91212 PaidDistribution=true InstallID=a045d04d-6cbb-4e2b-8227-7d14531c588c saBsiVersion=4.1.1.663 /no_self_update

C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe

"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91212 /s /thirdparty /upgrade

C:\Program Files\McAfee\Temp4094822419\installer.exe

"C:\Program Files\McAfee\Temp4094822419\installer.exe" /setOem:Affid=91212 /s /thirdparty /upgrade

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"

C:\Program Files\McAfee\WebAdvisor\UIHost.exe

"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul

C:\Users\Admin\AppData\Local\Temp\twkhqb0g.tyo.exe

"C:\Users\Admin\AppData\Local\Temp\twkhqb0g.tyo.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=KC

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul

C:\Users\Admin\AppData\Local\Temp\is-SBT13.tmp\twkhqb0g.tyo.tmp

"C:\Users\Admin\AppData\Local\Temp\is-SBT13.tmp\twkhqb0g.tyo.tmp" /SL5="$304A4,5773230,1034240,C:\Users\Admin\AppData\Local\Temp\twkhqb0g.tyo.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=KC

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /tn "Quick Driver Updater_launcher" /f

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im "qdu.exe"

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /Create /F /RL Highest /SC ONCE /st 00:00 /TN "Quick Driver Updater skipuac" /TR "'C:\Program Files\Quick Driver Updater\qdu.exe'"

C:\Program Files\Quick Driver Updater\qdu.exe

"C:\Program Files\Quick Driver Updater\qdu.exe" cntryphnno

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	234.16.217.172.in-addr.arpa	udp
US	8.8.8.8:53	drive.google.com	udp
US	8.8.8.8:53	play.google.com	udp
GB	172.217.16.238:443	drive.google.com	tcp
GB	142.250.187.206:443	play.google.com	tcp
US	8.8.8.8:53	ssl.gstatic.com	udp
US	8.8.8.8:53	apis.google.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	tcp
GB	216.58.201.110:443	apis.google.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	8.8.8.8:53	3.180.250.142.in-addr.arpa	udp
US	8.8.8.8:53	10.178.250.142.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	238.16.217.172.in-addr.arpa	udp
US	8.8.8.8:53	206.187.250.142.in-addr.arpa	udp
US	8.8.8.8:53	227.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	110.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	content.googleapis.com	udp
GB	142.250.187.206:443	play.google.com	udp
US	8.8.8.8:53	blobcomments-pa.clients6.google.com	udp
US	8.8.8.8:53	drive-thirdparty.googleusercontent.com	udp
GB	142.250.200.33:443	drive-thirdparty.googleusercontent.com	udp
GB	172.217.169.3:445	fonts.gstatic.com	tcp
US	8.8.8.8:53	21.114.53.23.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
GB	172.217.169.3:139	fonts.gstatic.com	tcp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	65.139.73.23.in-addr.arpa	udp
GB	142.250.187.206:443	play.google.com	udp
GB	142.250.187.206:443	play.google.com	tcp
GB	142.250.187.206:443	play.google.com	udp
US	8.8.8.8:53	drive.usercontent.google.com	udp
GB	142.250.187.193:443	drive.usercontent.google.com	tcp
GB	142.250.187.193:443	drive.usercontent.google.com	tcp
GB	142.250.187.193:443	drive.usercontent.google.com	udp
US	8.8.8.8:53	193.187.250.142.in-addr.arpa	udp
US	8.8.8.8:53	19.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	beacons.gcp.gvt2.com	udp
US	192.178.49.163:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	e2c47.gcp.gvt2.com	udp
US	35.206.80.10:443	e2c47.gcp.gvt2.com	tcp
US	8.8.8.8:53	163.49.178.192.in-addr.arpa	udp
US	8.8.8.8:53	10.80.206.35.in-addr.arpa	udp
GB	142.250.187.206:443	play.google.com	udp
US	8.8.8.8:53	beacons.gvt2.com	udp
US	192.178.48.227:443	beacons.gvt2.com	tcp
US	8.8.8.8:53	beacons2.gvt2.com	udp
US	216.239.34.117:443	beacons2.gvt2.com	tcp
US	216.239.34.117:443	beacons2.gvt2.com	udp
US	8.8.8.8:53	227.48.178.192.in-addr.arpa	udp
US	8.8.8.8:53	117.34.239.216.in-addr.arpa	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	8.8.8.8:53	94.65.42.20.in-addr.arpa	udp
US	8.8.8.8:53	188.98.55.23.in-addr.arpa	udp
US	192.178.49.163:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	flow.lavasoft.com	udp
US	104.16.149.130:443	flow.lavasoft.com	tcp
US	8.8.8.8:53	130.149.16.104.in-addr.arpa	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	8.8.8.8:53	sos.adaware.com	udp
US	104.16.213.94:443	sos.adaware.com	tcp
US	8.8.8.8:53	94.213.16.104.in-addr.arpa	udp
US	104.16.213.94:443	sos.adaware.com	tcp
US	8.8.8.8:53	webcf.quickdriverupdater.com	udp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
US	8.8.8.8:53	cdn-download.avgbrowser.com	udp
US	8.8.8.8:53	94.149.222.52.in-addr.arpa	udp
GB	23.73.139.73:443	cdn-download.avgbrowser.com	tcp
US	8.8.8.8:53	sdl.adaware.com	udp
US	104.16.213.94:443	sdl.adaware.com	tcp
US	8.8.8.8:53	www.freevpn.win	udp
US	104.21.94.230:443	www.freevpn.win	tcp
US	8.8.8.8:53	73.139.73.23.in-addr.arpa	udp
US	8.8.8.8:53	bits.avcdn.net	udp
NL	23.197.94.235:443	bits.avcdn.net	tcp
US	8.8.8.8:53	download2021.pdf-suite.com	udp
US	172.67.158.191:443	download2021.pdf-suite.com	tcp
US	8.8.8.8:53	235.94.197.23.in-addr.arpa	udp
US	8.8.8.8:53	191.158.67.172.in-addr.arpa	udp
US	8.8.8.8:53	230.94.21.104.in-addr.arpa	udp
US	8.8.8.8:53	package.avira.com	udp
US	184.30.157.241:443	package.avira.com	tcp
US	8.8.8.8:53	download.enigmasoftware.com	udp
FR	18.244.28.26:443	download.enigmasoftware.com	tcp
US	8.8.8.8:53	spyhunter-download-v2.b-cdn.net	udp
GB	143.244.38.136:443	spyhunter-download-v2.b-cdn.net	tcp
US	8.8.8.8:53	241.157.30.184.in-addr.arpa	udp
US	8.8.8.8:53	26.28.244.18.in-addr.arpa	udp
US	8.8.8.8:53	net.geo.opera.com	udp
NL	185.26.182.112:443	net.geo.opera.com	tcp
US	8.8.8.8:53	136.38.244.143.in-addr.arpa	udp
US	8.8.8.8:53	112.182.26.185.in-addr.arpa	udp
GB	142.250.187.206:443	play.google.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
GB	142.250.187.206:443	play.google.com	udp
US	192.178.49.163:443	beacons.gcp.gvt2.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	8.8.8.8:53	webcf.quickdriverupdater.com	udp
US	104.16.213.94:443	sdl.adaware.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
US	104.16.213.94:443	sdl.adaware.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.54:443	webcf.quickdriverupdater.com	tcp
US	8.8.8.8:53	54.149.222.52.in-addr.arpa	udp
US	8.8.8.8:53	ssl.gstatic.com	udp
US	8.8.8.8:53	play.google.com	udp
GB	142.250.187.206:443	play.google.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	192.178.49.163:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	cu1pehnswad01.servicebus.windows.net	udp
US	104.208.16.0:443	cu1pehnswad01.servicebus.windows.net	tcp
US	8.8.8.8:53	apis.mosaic.analytics.awscommon.mcafee.com	udp
US	52.38.128.194:443	apis.mosaic.analytics.awscommon.mcafee.com	tcp
US	8.8.8.8:53	0.16.208.104.in-addr.arpa	udp
US	8.8.8.8:53	sadownload.mcafee.com	udp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	8.8.8.8:53	194.128.38.52.in-addr.arpa	udp
US	8.8.8.8:53	48.139.73.23.in-addr.arpa	udp
US	8.8.8.8:53	analytics.apis.mcafee.com	udp
US	54.149.38.38:443	analytics.apis.mcafee.com	tcp
US	8.8.8.8:53	226.20.18.104.in-addr.arpa	udp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	8.8.8.8:53	38.38.149.54.in-addr.arpa	udp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	8.8.8.8:53	home.mcafee.com	udp
BE	104.68.84.174:443	home.mcafee.com	tcp
US	8.8.8.8:53	analytics.apis.mcafee.com	udp
US	54.149.211.47:443	analytics.apis.mcafee.com	tcp
US	8.8.8.8:53	174.84.68.104.in-addr.arpa	udp
US	8.8.8.8:53	47.211.149.54.in-addr.arpa	udp
US	8.8.8.8:53	sadownload.mcafee.com	udp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	54.149.211.47:443	analytics.apis.mcafee.com	tcp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	8.8.8.8:53	233.38.18.104.in-addr.arpa	udp

Files

\??\pipe\crashpad_3288_OXRVHPPEFWASJYJP

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	7f3c9fc1c96ccd75d57cb71129403e5e
SHA1	abba0a0991b4a6c57f42afadeb0c82f51e5d7c0d
SHA256	a5218241d91edb8da8ef0323d6ef9e3779e8e2fff4767e21ef8e1cdc55a47b6a
SHA512	a8085dc5012c327c3c803e8ac391a50577d30b9292f836919f64713357c8b9017fdb22c51f1161adcde78d0f619f30bfc038b10eae517b8fbfa46e099d64bccc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	94e360f07da68536dd118caceab15b3c
SHA1	72e6674a3f248a3ffa6137b95fe4dbaf5094f265
SHA256	e0d1985901008c47945ce2f036067be96794462055517bea9e5c35967b6aca8b
SHA512	0769809a4ddcb35ce741ecc76e0788684dfab8f5213049a05a7c99ba57d0ad74ca4d8d830d87ee5c91d2b80d99a22256ae5c663c53b73f670475b1b39c6e7a83

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	a50b9f8987001576037e205a4991c6c0
SHA1	ce196cd921f175786e502db8afe3ede6223072de
SHA256	6d2bc6e2b27b30fe60308f4b8be16c827c49638bc8327dc2a03f36b6adc0a226
SHA512	a13564a94b60e0d2be5d045cef0202d5b89288fb0c93412750da4103e8c6861b37a72779d41b4ca3cb3fa69d8cf6f5f169b73635e44d9a6cf34f85a620679c87

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	577327051ea8caf9ab8942018ee8cea2
SHA1	b8d9564b2e528cea893f78ed87ed1fd8b211a691
SHA256	f709e1f7e948d52968d2fb5ea7da61216cdf7e56ed17d60010a1384c9e5a514f
SHA512	ff5d332a4e9d7e21ba72f4c83a536b05791d67bd74e0ab1f041e45bae7368c2c87c4101225720fa1b51b542d73e0d14d9cbe230107a08ac77fa22e6a14a4827a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	d7895fb321a8615dc60d4c75fb20e4a5
SHA1	9931ebae422e63ca0881cb94678fdb0f52ea52c0
SHA256	fb3b0bbdc8694d62d3513feeaab5f4c82078bde374a24af884bfc0f4c11dcf30
SHA512	3df30ee9f909d19e35ab39e9bcd54d2c97a26d6ad14362c909526d0c16a0c7fd362676b2b893f9f494ad9b1d611dc93feeed2b922ed87c648115e9d8cbb6b501

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	812609faf958a39a617be6debe239376
SHA1	9e83d34a4e130897046111fa7060aa4f62695ccf
SHA256	2719725c5ca7eb0fafe7f699993bb29ea7f81ef050cb287da6c6a57f63a39ff3
SHA512	ee3dcb4dcd48b36ef5aeb52940fb64e59615411e22ef60cc369caf60b44133bf42774e836aaa0cdbbd3ea2d048b04ca68fd4ae1c615bf32b6ce83930236010b7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	3851ebe71f50268a1245c6fb812328d8
SHA1	421a52a893a44a62ca86c6c31c502075746e2029
SHA256	12f06a1a39445a6a8927553e95ffe8404d3821a05db0e7cb9561f7cb25eff5d4
SHA512	0440dcc13eadbb3e32a27f2357c78cb8b3c7b099e0ca87963fcd7293744d81ee18c1a4964cf46f9227cb95401e6be9c115078d7525cd43191f235f20e5b321b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe594dc8.TMP

MD5	fbde92de6225a19ba193c1d08d186198
SHA1	2c2d7769dc8fee3f6663e5bc7f1dedeeabd35768
SHA256	5dc78b3479df1a8ef4cd46fb8abe926603cd77a9e31a49bc191ce8fee65f79e5
SHA512	ad04fbe6c903f37c459f6db8eba6ea8954a4995cb0818816843d8ce943c1024cfe42f0a8f0dddbd514ec2e791013f73a577aa1626f5f760c67ad9776bdcf2cec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	0305fb522352bfee2a9a1dae6b015f2e
SHA1	92823f709669843d72bbeccf8301b4e9269127ab
SHA256	ac77525c32dcefab623e43ab509d6f4209489ae7bfc834d5ba5fda5d6fb4205b
SHA512	0f1abefba4ec75e11553f3d366d7013853b5252c8384525190476da0d52bb42c1d9a1c1c93097fd7962820611ec4bcafb89efbdc1def3112464d7240dca34ce6

C:\Users\Admin\Downloads\JDownloaderSetup.exe

MD5	c3c3b50075bd5c87cf500c255dd833fd
SHA1	0b3593f15ebc8424919857d08d016b2cda2b5161
SHA256	a43fa3db0a053119f73a7422453e54318a258a947e8c0fda294b09c52b7459fc
SHA512	f9bd8c26a63b3d7cf6d6f0686a93720f9d3007ae2f196bf195815761b5a38f9fb81f2de6400abd842cc634ab68a14db6741436295a0d667e0b51099dbaf13c9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	944f90977d659f5b1e036176f08ff3f8
SHA1	c592a41aae8a3071998b8aeff5b64fd3bca4e2fc
SHA256	3429cb88c3d98bd91747fe161bd55a3a0747cc6983bb497595913b3a93609c37
SHA512	04615efc6fd4ff1607f7243b30ae7af5ad6a9fcabe01c8fbf62c9bb867b510d977a09f40edc36bbb941253240043161777cb777652dd7b2f90b26517847bb42f

memory/5488-177-0x0000000074C60000-0x0000000075410000-memory.dmp

memory/5488-180-0x0000000000EA0000-0x0000000002CEE000-memory.dmp

memory/5488-186-0x0000000007720000-0x0000000007730000-memory.dmp

memory/5488-188-0x0000000003700000-0x0000000003708000-memory.dmp

memory/5488-187-0x0000000007730000-0x0000000007B14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\ServiceHide.dll

MD5	ceb35d7cf1620eb138a71c23059ff910
SHA1	6c1ebbfbbc30c8fc02c9742131115d4f760d2ee8
SHA256	b551b3066022b08e7da70e9bd191e691f8a26628633bd8524837319201ebd0e9
SHA512	dc8847c712f0071ec1d3982e05eb5d79cad22484b8e9e1c3c644607fb8d3f08b00b9b94aaadd84d3bed8e802c677df5a090e08589fef8c3fc246a5cb3ee2d813

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\vcruntime140.dll

MD5	1a84957b6e681fca057160cd04e26b27
SHA1	8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256	9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512	5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\msvcp140.dll

MD5	8ff1898897f3f4391803c7253366a87b
SHA1	9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA256	51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512	cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\OfferSDK.dll

MD5	dc6d53b383ae4a1389ec23e676afb866
SHA1	0bf4672988a05e292b99000ba5bcc805c1b16d0b
SHA256	49ee3c4bd541bb0f930ca8743aa72063b182db59548254354b0ccc5276295826
SHA512	8f4af4f5384a541e32a27e4489aeb75bd8d9002486ceb281acd62e592f9a3494d85622293b98d7bb5da9cf9f5803873db2bfe2431bfe7f6c9a516c091089367c

memory/5488-210-0x0000000007680000-0x00000000076B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OViewModels.dll

MD5	74d840d8263deaa875ce9bf40861625d
SHA1	876d6d704e61856f7a4625d13e23254d42383464
SHA256	cd201abf119a063673da03e9fe81e4157031993d3f6776ef0afe9c070600d242
SHA512	a350612516b364a6f1eed2ea4289b1c68d4aee9e4160811f4537e270307e8e25c0ddfdaba9725913a5dd6fb179483247bad4f4c6cb19db2cca8b2da356854bd3

memory/5488-218-0x00000000076C0000-0x00000000076C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\SciterWrapper.dll

MD5	f9ccf333b9891dcc26c780593f706227
SHA1	159e902ef413c6a7e2a668913c3a7c52ff4833da
SHA256	ec5c5e6dabbf9a9cfeef6bb6c5e842c3ee0d5906224b7c30610f736a791ae3dc
SHA512	94214410d1b9ff7782abb6efce794ce3f51af2512686055a27dd5875bf34c7b1610ae5fef60f197c8c46259d930eb17ebd887f7b92b01f1182ca266735e1af7e

memory/5488-226-0x0000000007C10000-0x0000000007C3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Ninject.dll

MD5	8db691813a26e7d0f1db5e2f4d0d05e3
SHA1	7c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA256	3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
SHA512	d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

memory/5488-234-0x0000000007C40000-0x0000000007C68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OModels.dll

MD5	7a4ddb62db0d21cea4ab724e4ad732fd
SHA1	4cdbfac30ac141b6db788c4e4a9eed680ba5ad21
SHA256	41547db61fc5e43e0557ceb44670cbc40ea373feb9e7808fa357fded36d7748d
SHA512	523fe5f4729b06942c252db908d01c48261ce7224995e4d361f4084321893459850aef8ddd18a25474d3685fdf512dfe2f583c0fb749861cf744df1cc46cf440

memory/5488-242-0x0000000007C70000-0x0000000007C8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OServices.dll

MD5	45631ab991cd733c675a5d0abcea00e8
SHA1	acad2f57465173b823541c05588f018559dcf2e7
SHA256	21a2bb14ce7a73a1ab28f0178e9c9a3a8add4d893a3934b465f812d8d541155c
SHA512	5262134ec99aae19f339d8fa814b583f6f407a84d1edfc6844b06f1907b32ccf29a878adc171392b6d7b49d788aa5c0de7b667be65bc950d86ea1be04184b0e8

memory/5488-250-0x0000000007C90000-0x0000000007CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OUtilities.dll

MD5	e0ffb8f465efc031de785b841564b1fd
SHA1	ad8a16e081032d4523ea3e84429f07e3aaf7feef
SHA256	1da093c90f1ef01776b506b151ea2b525155344a337b057d1c04665ce1d12de1
SHA512	6fa34f9b1e76fd18f3d136d55cf2f2d652756831fbb67db7d4cc2224892483a6b621e7bb4c925db43ab8e999727ed9dda37360358628adb904d4979456b153ac

memory/5488-258-0x0000000007CC0000-0x0000000007CE6000-memory.dmp

memory/5488-266-0x0000000007710000-0x000000000771A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2ODAL.dll

MD5	4f54b457229815dfa6174eecb2cd639b
SHA1	401d38258e91c9c3a8d5a5ac5cbc6b2e861301de
SHA256	7d3013499d2ec43a6b377ae7ab563248ebcfc09a8f0e4a6bd6a0043292010873
SHA512	fb4373b8f6dd5acc88c3cbb10116f394b5ce7bec078ed04da633c620b0e84ac6cfbfc03ad18b335ceb7e43adfc36e0c7eb19920788fa117f6f0d366e0ccb5ffb

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\HtmlAgilityPack.dll

MD5	17220f65bd242b6a491423d5bb7940c1
SHA1	a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA256	23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
SHA512	bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

memory/5488-274-0x0000000007D90000-0x0000000007DBC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\ServiceHide.Net.dll

MD5	f534c11d6a35477b069e3fe23b004394
SHA1	1e13a0cbbfd33ee4174f2289c9549967c2a28ad2
SHA256	28dd9b9fc9d950fc9c5d27bcdb78aa76803ca7aa8dae8311f8e51700b9bb3e21
SHA512	b64bcd1796396a4e443a2199ac8d294b6492798dd2c56d067705a673661d8bc7b3b4337cea9000bbc188c9b82969ebfce412af1d071315228f6a50c2dfe915dd

memory/5488-284-0x0000000007D60000-0x0000000007D7D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\MyDownloader.Core.dll

MD5	f931e960cc4ed0d2f392376525ff44db
SHA1	1895aaa8f5b8314d8a4c5938d1405775d3837109
SHA256	1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA512	7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

memory/5488-301-0x0000000008300000-0x0000000008312000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	1ae09d305568fd294574993bca8e8a10
SHA1	d2c9d1bc91d62edf0f014757f2dd4f770d8d2d44
SHA256	1cb992eda2eacd28c87211d6f91c327479845ca3f86ab29951a4e07242261790
SHA512	334303b7ed0161ea9163306e3691806289452670a054afe750158322dbb7e465de3b1c04dedcbfb488c39a7ae2c36ce859ad7301f60215bb85c74bb17df519db

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Newtonsoft.Json.dll

MD5	9de86cdf74a30602d6baa7affc8c4a0f
SHA1	9c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA256	56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
SHA512	dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

memory/5488-329-0x00000000089C0000-0x0000000008A4C000-memory.dmp

memory/5488-334-0x000000000D1B0000-0x000000000ED7C000-memory.dmp

memory/5488-335-0x0000000007FE0000-0x0000000008002000-memory.dmp

memory/5488-336-0x000000000ED80000-0x000000000F0D4000-memory.dmp

memory/5488-342-0x000000000AD10000-0x000000000AD1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OResources.dll

MD5	cfb06ff92b4bbbb61eb9fea6b9a866ee
SHA1	5998200da6c043a82d3f7b37e4770bad80f2787e
SHA256	da79b3c64ddf384b3d6c1864c3dd3bad1973f53db14db6623e360e41156ab796
SHA512	58197170fad4d931cf3f55b376d1c14d8c86a28a86c7141a0b1faf34025928a28444617565b0924250f6193104cd1b02501ec0ae438083336624fa3d41585525

memory/5488-345-0x000000000F890000-0x000000000FE34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OCommonResources.dll

MD5	412ba91898313a54cf7db18b0e9e610d
SHA1	f1d893e079cd4599fbf0c862df337476c42be91b
SHA256	31640fb6e193a987986c6b655110189d8e30408b00234c955158973ec9e97b71
SHA512	8dd0e3e8ebe43379c5002f6133c49e509964b26fea8c46ed8dfc2687211c6d3a000cfc04edd2dd9d34df03400b5640f5172fa22913d65a784be191aa995ea558

memory/5488-351-0x0000000010400000-0x00000000109B4000-memory.dmp

memory/5488-362-0x000000000F4D0000-0x000000000F562000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\sciter32.dll

MD5	b431083586e39d018e19880ad1a5ce8f
SHA1	3bbf957ab534d845d485a8698accc0a40b63cedd
SHA256	b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
SHA512	7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\MyDownloader.Extension.dll

MD5	28f1996059e79df241388bd9f89cf0b1
SHA1	6ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256	c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA512	9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

memory/5488-385-0x0000000010360000-0x000000001038E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	5c687026e5dce9f3744e90e0914eae00
SHA1	8dd1dae2ef94d9a5589d7bfdb57a237713e66200
SHA256	58c6640c9a31a4f9cdf6d3ea522d0af3ef794345826d80aeaadd8b8a7e98fc55
SHA512	b2e410fc48a881200f081c81bbdce137b8cc0b17ee441f4611421085e649fca0bfec0dae772d8d69f4a041f6c73cd170b2318a1ac6bb3d58dfb588f041ba19ee

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\Config.tis

MD5	bf5328e51e8ab1211c509b5a65ab9972
SHA1	480dfb920e926d81bce67113576781815fbd1ea4
SHA256	98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA512	92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\app.ico

MD5	1f0fa25c629e147a347578677ef48c43
SHA1	55067928730e6781b657f26242c13ccc843c06ea
SHA256	ca4422f74242954350de35efa9db4f92ff748ad278b56cecf02c0ca9192460f2
SHA512	baa962508eb3c5c1277f01f25e68b10017d2e0d7dfe876253d54497aa6e9bd6f2f1b4d88fc82bea962e4c252654fcbaf3c12a07e2097dd57ea62aa9aa192f80a

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\style.css

MD5	362fa1bf3819e45f44dea23764464801
SHA1	6ac9c0b66e3dcae13d04fe55467e06b98f245081
SHA256	676c33de0bcd9869319dcde8158da5cd4b49499240592bf6b95122068b23bb11
SHA512	34403c23927be775e96bf57a6ce702af8109cffb26608f5a49cd7e3cabbad358da30a0eaa36927cc7a9f01d61ba5f720ccf41c1f9dc5a97f1de940e83637fdca

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\EventHandler.tis

MD5	1116d7747130f4552a91e61a3a6000b1
SHA1	bc36996a664dab24b941ec263679c9d6322e61a2
SHA256	5c09c6784f3fdc4a6b2998c4c9e02e366265ee5314c0f982859825576dc0eafd
SHA512	af34413f242b64737ac9f7076e449b0d0485842d653d1cad12b54b868f09817d3595cd935ad7e03003d536127c173d624dd9a031c079fdb8f897ab0b7b9474e8

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\ViewStateLoader.tis

MD5	85c33c8207f5fcb2d31c7ce7322771ac
SHA1	6b64f919e6b731447b9add9221b3b7570de25061
SHA256	940ef5e9f28da759fbf3676fba6da5cc4199b78ffc4fefe078ab11d53e70fb0a
SHA512	904188ab57cfb4f3d8c51eb55746ae2589852f271b9fa3840b82bda93f69c9f985e65f67169302d08818b707f36246f83f245470d5175dba5f0ad3a2482740c4

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\Log.tis

MD5	cef7a21acf607d44e160eac5a21bdf67
SHA1	f24f674250a381d6bf09df16d00dbf617354d315
SHA256	73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
SHA512	5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\TranslateOfferTemplate.tis

MD5	551029a3e046c5ed6390cc85f632a689
SHA1	b4bd706f753db6ba3c13551099d4eef55f65b057
SHA256	7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
SHA512	22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\OfferPage.html

MD5	7c9ba4307c8fa852cdc21898f0638980
SHA1	5f5b065c46aa8a629f95db2e4e47c5c5435c4622
SHA256	c8a08eada415de5cfe32d174d78ffd8750cc9336be8f5688d87c8cda6d2ce7a1
SHA512	fbbba6ecdefb39376e5c71439323b38f20ec47cc6c633d69da5440609b4dd545a8fcb2ffa9998b6c99ed4baa55c42496cc212058c8bbca99c4b9b6eca6278a56

memory/5488-465-0x0000000074C60000-0x0000000075410000-memory.dmp

memory/5488-466-0x0000000007720000-0x0000000007730000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	4f2eb592d402344e3ff5806aaa1af2bc
SHA1	51c05189fa9d254bf21e620149486063180d996c
SHA256	6005b032b8b4a5840b1099797b9020825a4ccc76fc85f285fc2677637675d517
SHA512	2dde263e0436a985e50a761bd1b0e5b4ac47f6208cf8d6876efc1817cc423389e59075fc9d994ca571bc6097443b64fd2144d89be7e6f77b0ed34eb011e43745

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe

MD5	a7bea54cc86e33386a7aeec02ef77100
SHA1	78059909f44c36933de0054b9f19b4fd09b8ca02
SHA256	21a096298cbc3189ce0462d07ae3bb7192794c7c77931db835b4936d25d315a7
SHA512	74ef995bf6f3f164b5981b0cf284862ad458139485341d93cd791901fa965a35c53a362db94c098c4baad9188426ffebd2e8c6dfc5b662c4b5af3540b27f9822

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	4c0725b4264303c2e9dd6667bb09547a
SHA1	3c4ff64ff5f82860f3b348b4660d610abbeec2f3
SHA256	74fd4ef7622b9dce99e153f6c9d44cc90b9c50efc3982bc5630c3a3148d38ecc
SHA512	9f5d743749c466a5cfe9b2664e9d560e30df2f8341a33d8551a717c8c22729d6d22db986b9b47aff710f8eeb954110e8718c4614c163728f45c2db1c0aec34ae

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	86c3f4c8988416e6347c51fad77a0316
SHA1	cd8db338186dd901e59878e27c77a73caddccc49
SHA256	e190d25aeea592a352af64339a3dc48eb6e9e91d720d64548271cb4edf22700e
SHA512	4920ffdde5b3ae14692c051eac01f85d85224e989bc7a3aadf8aae17807d9e5c4edfb25fb34d76423aa3954874f3a001f498d593e65944584e662f7c67cd528e

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	9dc03b63a1bfe292338f8fec8948e82e
SHA1	a03f23a9cf6039331b1e31251effbf7e603be441
SHA256	8d305a22a5ee39cebf7d1e80eb631d3c05dd227ee24768f2bc5ec12c7852b6b0
SHA512	3ae623d3213ad2c9c82dd02d3c110bd5d2b46160287e597ff1a104139c5ba25f71a5a90e34c44c809ba3388161ec7a5c80af275c1b2708dbef547547c1a8ed50

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	6025546e1ee412e74b6207b827721f8a
SHA1	ba42daf204a0089bb9c7d5982293d2f9a500dfd3
SHA256	22946945e979711d70288853835fb0437ccf466a6bcf2a65187ed65fa565a037
SHA512	69424d9b298f6bce76fcc73d42c8212c1e4fe47f6ed7bf5cfbadb3f9ea13a17adff24e61cc7a034d3777cfd69020b38d81eab3b1423839421946b5b7d1f340ea

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	fd10506d31ba43db41faa91d0cd09d09
SHA1	d4713fd9855188d19f44e952aeb76fc4e0836d61
SHA256	5721b8fc15211f93d917aebe6bdfdeda12350a626d2a3b030a6a37eaae782789
SHA512	655727cc0e5317cbf44923450e1acdd76c5364dfbd5f275a00f3464d3d96f4fa8161cf81df049f3371a1d10acfa330f8d352688bf9da680a4a02a9b0895976b4

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	dce0d572f3c451014de696e674b7a9d9
SHA1	53e273f0e6e1ba474720ca3e3f734c67bd10c796
SHA256	d3f7a627628d9923c35038fb209d505265ab9a7f61b161b690d4f1f846f2c353
SHA512	978afbfcf0d61c8d70c4b284deed2ffca6517a8ce99e198f638a1059c42cc8492be2f827200234464c92f13e85128338c6b243941c2a7d8726781f49cd7e5e3e

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	ed13519723e904a2b53ebdfb1026515f
SHA1	8eaf312409b6143d5c71cdcc511e3baa0f15378d
SHA256	ba6e2829a02287eaef1314bfbd0fb4ec81f621d4ffcfd4ebd63bf519b676d1c1
SHA512	72c9375e85378d5ae5d43417c8e7a8924966124d5fe89d730c8482b40ff516cbb02a3f72d405973cb97e20b9444f18c47721927f8c2c2c82f3a22a75580d7f3b

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	f7b6a343fc73e9ce602f09a983425ad0
SHA1	22fec37477d321d46ffbddee956b6652312ad7ec
SHA256	4ba4a8d2b124fc31a4fe6d1f22c176f33ccf224146c12f69125fa37a98385443
SHA512	b16d99f0ce5b585a1b9bd7ba20803733da260558de9781357ffb753633ac3390b2ff5ddaa2fff8bb5cc44e985ae6c0a5150d6629958529525b9b2d7fb587891a

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	b2c8e5c11081fda39ae5b01d008b5159
SHA1	56bc4c22f90d5b7e851bc076401d401aeb24c409
SHA256	312767e60ce487788455c27b8e334dfbe73345b825314be3bdf4b442b635ad90
SHA512	d0a7bcea4a6f137816dd5c02663d2c8009de2036b22f0a1b215a50bbd0eda9179cf4594741cf38e7699305e9ccc8dc80c1ecb34b4651d1f316970418b6d0aaaa

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\unpack200.exe

MD5	8a7e94d3c3c2306ade5f2ea359cd46c3
SHA1	18c4a4549d990438ba734c4f7c3a4ef795e4297c
SHA256	09147c13d553dc415af12deadcaa9f11c042b7b94ada6479cf2b598a2cc2db0b
SHA512	220592f6af2ce1dcfedd0d29195d066508ca097604a2198f52d9a32b8d85e0953d62768c02922ac2a898fc410e6b7b9d80d870660ce602245182cc5f63cdbad8

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\bin\MSVCR120.dll

MD5	d4fca957f344859d45ad0274860180b4
SHA1	0bb8a7a895ab8875bb03048a4541029ee665a4f2
SHA256	c084c86d1642a7775a36e85223cd80549bbee887d6e8b133f5953c37e7ce0e0a
SHA512	934c799f8f155aa381a6c7d3208dc5086fa7bd44a114ad7f0bfe3906e555cd766122f43418d8978cb52538e0ab14fce9e6154064dcaa121e205527a3b718acfa

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\lib\charsets.jar.pack

MD5	715bf147a0a6c08d80896c05b1f0a8f8
SHA1	c32f60783b8f88d1156f281292840c9363161cd6
SHA256	73f724323430aa8433d3f1a9a7cdc32f3450d9778253de40104cc3b7f9becedc
SHA512	6b447fa4c2e5299ac66ee4ae74cb37930b71e1be685a45e9e09c297fce69aac6b0293101220f8d84bbdc8c7a2d3e217ff24e5c07f1dc4108ac3db9f7b5d1a931

C:\Users\Admin\AppData\Local\Temp\e4j2DED.tmp_dir1713098339\jre\lib\jce.jar.pack

MD5	65b6533ab0d6f390ccc9278bf8537493
SHA1	b188b52fa108e44504bbd8b7bcbcf6dc15a26779
SHA256	73535750ca73c8e4a448e8df7dc3c052a1944e01248f694a5108ac9020b3fb6d
SHA512	c2d0d68e24f0a000a9ee9ccc0b394dc185cd006c62e59715996b40cb6b8d204cf437e260ba022823a45133a5af5db5ef3e81e9a9ab7a86bfd0851d3dda00f452

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	c4be702ddb75bec80cfa62abfc2f7939
SHA1	0fd5816addd1540ec8d4273ca7ea0b4a0dc91564
SHA256	fc02b7599eba1dc4c1f21ae504c70a79fb99fb842735b3215620efced45a3fc7
SHA512	e110bf8a34fb85f746fbcf25f3350ca206d3a7310bd15e2c502ab4f4a8d03d7266844320a3ae264e3dad8265972ae66a95cf2e0090ea44703a4f05e04a8e670e

memory/6004-1298-0x0000000002E10000-0x0000000004E10000-memory.dmp

memory/6004-1308-0x0000000002E10000-0x0000000004E10000-memory.dmp

memory/6004-1313-0x00000000013E0000-0x00000000013E1000-memory.dmp

memory/6004-1315-0x0000000002E48000-0x0000000002E50000-memory.dmp

memory/6004-1316-0x0000000002EB0000-0x0000000002EB8000-memory.dmp

memory/6004-1318-0x0000000002E10000-0x0000000004E10000-memory.dmp

memory/6004-1317-0x0000000002E50000-0x0000000002E58000-memory.dmp

memory/5764-1393-0x0000000002380000-0x0000000004380000-memory.dmp

memory/5764-1408-0x0000000002380000-0x0000000004380000-memory.dmp

memory/5764-1419-0x0000000002380000-0x0000000004380000-memory.dmp

memory/5764-1463-0x0000000002380000-0x0000000004380000-memory.dmp

memory/5764-1462-0x0000000002310000-0x0000000002311000-memory.dmp

memory/5764-1475-0x0000000002380000-0x0000000004380000-memory.dmp

memory/6016-1480-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/5764-1485-0x0000000002310000-0x0000000002311000-memory.dmp

memory/6016-1483-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/6016-1481-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/5764-1486-0x0000000002380000-0x0000000004380000-memory.dmp

memory/6016-1490-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/6016-1494-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/6016-1499-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/5764-1505-0x0000000002380000-0x0000000004380000-memory.dmp

memory/6016-1503-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/6016-1506-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/6016-1508-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/6016-1495-0x0000014D9F970000-0x0000014D9F971000-memory.dmp

memory/5764-1510-0x00000000023B8000-0x00000000023C0000-memory.dmp

memory/5764-1512-0x0000000002458000-0x0000000002460000-memory.dmp

memory/5764-1511-0x0000000002438000-0x0000000002440000-memory.dmp

memory/5764-1513-0x0000000002478000-0x0000000002480000-memory.dmp

memory/5764-1515-0x0000000002490000-0x0000000002498000-memory.dmp

memory/5764-1516-0x0000000002448000-0x0000000002450000-memory.dmp

memory/5764-1517-0x0000000002460000-0x0000000002468000-memory.dmp

memory/5764-1518-0x0000000002468000-0x0000000002470000-memory.dmp

memory/5764-1519-0x0000000002470000-0x0000000002478000-memory.dmp

memory/5764-1514-0x0000000002380000-0x0000000004380000-memory.dmp

memory/5764-1520-0x0000000002480000-0x0000000002488000-memory.dmp

memory/5764-1521-0x0000000002488000-0x0000000002490000-memory.dmp

memory/5764-1523-0x0000000002380000-0x0000000004380000-memory.dmp

memory/5764-1524-0x00000000024A0000-0x00000000024A8000-memory.dmp

memory/5764-1522-0x0000000002498000-0x00000000024A0000-memory.dmp

memory/5488-1529-0x00000000031F0000-0x00000000031FA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	0ff404433aeeb437779d9a055a7f393e
SHA1	02a55bf36cec245f8924a3b2e7af5975f14558bb
SHA256	e8a415f468c3bd6f0d836f6406d163dcdcbc7acc3816d776ca963145a0eca845
SHA512	896bbc8d1a8a976f2718e220bdb64fa56ae04e395866fc6ecd43e0da87375222a8655eb971803378041a94da9790225c1e512ee43090097de898e0668c46009f

C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe

MD5	143255618462a577de27286a272584e1
SHA1	efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA256	f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
SHA512	c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9

C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe

MD5	d2272f3869d5b634f656047968c25ae6
SHA1	453c6ffa6ec3a0a25ae59a1b58a0d18b023edb16
SHA256	d89a2423da3704108861f190e1633d2100ecc30b4c40bd835ce54a6934887bc9
SHA512	41072ef6f382cf6d4d97ebc2a49a50a9bd41b53508a8586fd8d018e86aed135e8ac2cdd16bbf725e4f74f14ecfcf49789d3af8924b6d5dfa6b94dc6bf79a0785

memory/5428-1698-0x00007FF6C0A80000-0x00007FF6C0A90000-memory.dmp

memory/5428-1699-0x00007FF6C0A80000-0x00007FF6C0A90000-memory.dmp

memory/5428-1712-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1721-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-1735-0x00007FF6B7C90000-0x00007FF6B7CA0000-memory.dmp

memory/5428-1780-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1837-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1821-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1835-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-1855-0x00007FF6B7C90000-0x00007FF6B7CA0000-memory.dmp

memory/5428-1865-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1875-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-1872-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1847-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1843-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-1911-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1904-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1947-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1893-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1831-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1828-0x00007FF6B7C90000-0x00007FF6B7CA0000-memory.dmp

memory/5428-1812-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1806-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-1805-0x00007FF6B7C90000-0x00007FF6B7CA0000-memory.dmp

memory/5428-1770-0x00007FF65D8F0000-0x00007FF65D900000-memory.dmp

memory/5428-1734-0x00007FF65D8F0000-0x00007FF65D900000-memory.dmp

memory/5428-1764-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1761-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-1988-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-1982-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-1999-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-2026-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-2023-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-2022-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-2031-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-2029-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-2056-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-2083-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-2101-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-2166-0x00007FF6C1EC0000-0x00007FF6C1ED0000-memory.dmp

memory/5428-2230-0x00007FF6AA3C0000-0x00007FF6AA3D0000-memory.dmp

memory/5428-2261-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-2382-0x00007FF676100000-0x00007FF676110000-memory.dmp

memory/5428-2546-0x00007FF6C0A80000-0x00007FF6C0A90000-memory.dmp

memory/5428-2547-0x00007FF6C0A80000-0x00007FF6C0A90000-memory.dmp

C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

MD5	725b38a2b2022c0d5f465d6e90ffd0f8
SHA1	f42c185d018f0c4ef62a2d74d07d78c0af1a1d1b
SHA256	2ea7704f6cb967c19843c08e00ac70f3031eba16284075387008066c05bc28d1
SHA512	86a65e08baf33936dcd511be51392831eed1851ccbe44d7ee47356ed8389f54245f1fb15d934c911d33ce82bdec2c5677ab3fd8d21a0c09a7b4643d996b47bfb

C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab

MD5	6f97cb1b2d3fcf88513e2c349232216a
SHA1	846110d3bf8b8d7a720f646435909ef80bbcaa0c
SHA256	6a031052be1737bc2767c3ea65430d8d7ffd1c9115e174d7dfb64ad510011272
SHA512	2919176296b953c9ef232006783068d255109257653ac5ccd64a3452159108890a1e8e7d6c030990982816166517f878f6032946a5558f8ae3510bc044809b07

C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

MD5	2ffcdcf296cacc4c00f8b14ad4e9dbc5
SHA1	e803d8a7d4c5d4f77cd27f6ad030f87b04b65c47
SHA256	777d0caefc78b5d54443ce37e2e8b2d9b72a184b7ea8ed58e0c17782c5616680
SHA512	4fa9a4cad57815cd5ec2aa46b9ebdc1d50074ad8f6421b7f4f8d4aaaaedce8eb30d22ba6eec282729f53f6747e366abdc22fbd8d96eff54a8ee58803fd2c9133

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	45e7d82d4ef2dce12716a99c2dd1e8a2
SHA1	a023eb105ccd366dce45d186ceec4873501c1eed
SHA256	f9f61b37e02d82082b25a5e43d68cb1d2f3e766bf3c5731264ee7f8a7f5aa6bf
SHA512	00971b67a48e4c304fab22841ce4223dda5e663cb7b56d9a4760d31371b205fcef790c04e8b688aeaa1e8b64bcc65582fbda6e3f6c58cd650e1df8de84bcc6b7

memory/6004-3031-0x0000000002E10000-0x0000000004E10000-memory.dmp

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	54fb6fce3e1a10b96640df40d807fb77
SHA1	5f4fba73e6ce9532b89919e927f31600a158c133
SHA256	eee08e222a0ed3341e99738c9ab14300b49b4f71861fac69159d201f8e3bc356
SHA512	168f16428f688d1594328b302aa229880e0512d89a1efe8e0dd1dc1330b30a5ea2c1ad51eac3b52ad9d39836cc1a361f67b5e0ed78fa087f7bc2b1b17d2707ab

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	5dbe2cef859fb20c6dfc5f5056b533bc
SHA1	a6df485b6cb04ccae6a4da81c53315cca544610d
SHA256	277924f608f7cd301ddcce5d8e017495605a844cb05d86f47edf7063ac5fe857
SHA512	85306efbffe4b3a264fecf3697e1c2ad7d5cf673b5155c0f3a397a7828375a76001ef267d90e6243847616d580fdc4bb697ac3a6d8f20a9b7cdbc16cfc47d540

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	23b242a5a5f1c5baec0e274519fa8c6e
SHA1	7104f5f54aa08ddb35e90dbf69b7e62cb97f6c8a
SHA256	5662189178d44b041185e9bb48884cc7ff203f895b5eb0c1d558d5b0906c8fa3
SHA512	5a1242fa1c321e7e77d5543465e9136c0ea47ea4ae890959f9786d72195d4fd343d6b7a684525cd34491e4f3383fc95ecf63dbe29c3d4bd6d0b38a61499a8a47

memory/744-3384-0x0000000000400000-0x000000000050A000-memory.dmp

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	65aae5227d9fed42ba3a9c723cf6e02f
SHA1	1b712be8c7cf3a3134831f5e52580c8c540ffc1b
SHA256	e5425b7cc48d0ccfdcb3c2dd6d52dae812e096dd3bda22d30971962f3dc9c8ef
SHA512	3a0c0f1806abc99ac56217d46a1105626fdb5bcac021d62b1b8e0bfe6c0e190b5967960610bb449c933d457b20185ad725194dd7d6f13629edc74c976af22092

memory/5912-3420-0x0000000000B80000-0x0000000000B81000-memory.dmp

C:\Program Files\Quick Driver Updater\unins000.exe

MD5	348e9aad9e445392ba5c9fe96daf6f8b
SHA1	e04d450778d05cabb111903892dda0cdb288cd98
SHA256	5bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53
SHA512	c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024

C:\Program Files\Quick Driver Updater\qdu.exe

MD5	dfe06df90a37a45b23e33f510dda9554
SHA1	370edde62c86c1cdae423e966c6e31d5f0bffb58
SHA256	68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546
SHA512	c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

memory/5320-3656-0x00007FFE6B2C0000-0x00007FFE6BC61000-memory.dmp

memory/5320-3657-0x00000000013E0000-0x00000000013F0000-memory.dmp

memory/5320-3667-0x000000001C790000-0x000000001CC9E000-memory.dmp

memory/5320-3668-0x000000001CDE0000-0x000000001CF16000-memory.dmp

memory/5320-3669-0x000000001D3B0000-0x000000001D784000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-14 12:30

Reported

2024-04-14 12:40

Platform

win11-20240412-en

Max time kernel

275s

Max time network

330s

Command Line

Signatures

Bazar Loader

loader dropper bazarloader

Bazar/Team9 Loader payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A

Checks for any installed AV software in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	drive.google.com	N/A	N/A
N/A	drive.google.com	N/A	N/A

Creates scheduled task(s)

persistence

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\schtasks.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133575717466476830"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A

NTFS ADS

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Downloads\JDownloaderSetup.exe:Zone.Identifier	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\JDownloaderSetup.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A
N/A	N/A	\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdf2bfab58,0x7ffdf2bfab68,0x7ffdf2bfab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2112 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4120 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4384 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3396 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5624 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6004 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=736 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5820 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:8

C:\Users\Admin\Downloads\JDownloaderSetup.exe

"C:\Users\Admin\Downloads\JDownloaderSetup.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2504 --field-trial-handle=1796,i,1524562309701680611,13814682236899927723,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\charsets.jar.pack" "jre\lib\charsets.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\jce.jar.pack" "jre\lib\jce.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\jfr.jar.pack" "jre\lib\jfr.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\jsse.jar.pack" "jre\lib\jsse.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\management-agent.jar.pack" "jre\lib\management-agent.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\resources.jar.pack" "jre\lib\resources.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\rt.jar.pack" "jre\lib\rt.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\access-bridge-32.jar.pack" "jre\lib\ext\access-bridge-32.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\access-bridge.jar.pack" "jre\lib\ext\access-bridge.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\cldrdata.jar.pack" "jre\lib\ext\cldrdata.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\dnsns.jar.pack" "jre\lib\ext\dnsns.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\jaccess.jar.pack" "jre\lib\ext\jaccess.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\localedata.jar.pack" "jre\lib\ext\localedata.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\nashorn.jar.pack" "jre\lib\ext\nashorn.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\sunec.jar.pack" "jre\lib\ext\sunec.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\sunjce_provider.jar.pack" "jre\lib\ext\sunjce_provider.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\sunmscapi.jar.pack" "jre\lib\ext\sunmscapi.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\sunpkcs11.jar.pack" "jre\lib\ext\sunpkcs11.jar"

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

-r "jre\lib\ext\zipfs.jar.pack" "jre\lib\ext\zipfs.jar"

\??\c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe

"c:\users\admin\appdata\local\temp\E4J37F~1.TMP\jre\bin\java.exe" -version

C:\Windows\SysWOW64\reg.exe

"reg" query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings"

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\saBSI.exe

"saBSI.exe" /affid 91212 PaidDistribution=true InstallID=1dc86a8f-c6d5-46d6-a8d5-b00a64ec4416 subID=KC

C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe

"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91212 PaidDistribution=true InstallID=1dc86a8f-c6d5-46d6-a8d5-b00a64ec4416 saBsiVersion=4.1.1.663 /no_self_update

C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe

"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91212 /s /thirdparty /upgrade

C:\Program Files\McAfee\Temp2674636286\installer.exe

"C:\Program Files\McAfee\Temp2674636286\installer.exe" /setOem:Affid=91212 /s /thirdparty /upgrade

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"

C:\Windows\SYSTEM32\regsvr32.exe

regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"

C:\Program Files\McAfee\WebAdvisor\UIHost.exe

"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Users\Admin\AppData\Local\Temp\c0npcisb.pbu.exe

"C:\Users\Admin\AppData\Local\Temp\c0npcisb.pbu.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=KC

C:\Users\Admin\AppData\Local\Temp\is-1M51T.tmp\c0npcisb.pbu.tmp

"C:\Users\Admin\AppData\Local\Temp\is-1M51T.tmp\c0npcisb.pbu.tmp" /SL5="$50236,5773230,1034240,C:\Users\Admin\AppData\Local\Temp\c0npcisb.pbu.exe" /verysilent /ppi=1 /ppinag=2 /ddtime=500 /delay=10 /source=lvstqdu /pixel=LVS5091_LVS4980_RUNT /pubid=KC

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /tn "Quick Driver Updater_launcher" /f

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\System32\taskkill.exe" /f /im "qdu.exe"

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /Create /F /RL Highest /SC ONCE /st 00:00 /TN "Quick Driver Updater skipuac" /TR "'C:\Program Files\Quick Driver Updater\qdu.exe'"

C:\Program Files\Quick Driver Updater\qdu.exe

"C:\Program Files\Quick Driver Updater\qdu.exe" cntryphnno

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe

"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Quick Driver Updater\qdu.exe

"C:\Program Files\Quick Driver Updater\qdu.exe" silentlnch

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	3.180.250.142.in-addr.arpa	udp
US	8.8.8.8:53	10.178.250.142.in-addr.arpa	udp
GB	172.217.16.238:443	drive.google.com	tcp
GB	142.250.187.206:443	play.google.com	tcp
GB	142.250.179.227:443	ssl.gstatic.com	tcp
GB	216.58.201.110:443	apis.google.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
GB	142.250.187.206:443	play.google.com	udp
GB	142.250.200.33:443	drive-thirdparty.googleusercontent.com	udp
GB	172.217.169.3:445	fonts.gstatic.com	tcp
US	8.8.8.8:53	110.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	33.200.250.142.in-addr.arpa	udp
GB	172.217.169.3:139	fonts.gstatic.com	tcp
GB	142.250.187.193:443	drive.usercontent.google.com	tcp
GB	142.250.187.193:443	drive.usercontent.google.com	tcp
GB	142.250.187.193:443	drive.usercontent.google.com	udp
N/A	224.0.0.251:5353		udp
GB	142.250.187.206:443	play.google.com	udp
GB	142.250.187.206:443	play.google.com	tcp
GB	142.250.179.227:443	ssl.gstatic.com	udp
GB	142.250.187.206:443	play.google.com	udp
GB	142.250.200.14:443	google.com	tcp
US	192.178.49.163:443	beacons.gcp.gvt2.com	tcp
IE	209.85.203.94:443	beacons2.gvt2.com	tcp
IE	209.85.203.94:443	beacons2.gvt2.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	104.16.149.130:443	flow.lavasoft.com	tcp
US	104.16.212.94:443	sdl.adaware.com	tcp
US	104.16.213.94:443	sdl.adaware.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
GB	23.73.139.67:443	cdn-download.avgbrowser.com	tcp
US	104.21.94.230:443	www.freevpn.win	tcp
NL	23.197.94.235:443	bits.avcdn.net	tcp
US	8.8.8.8:53	download2021.pdf-suite.com	udp
US	172.67.158.191:443	download2021.pdf-suite.com	tcp
US	184.30.157.241:443	package.avira.com	tcp
FR	18.244.28.26:443	download.enigmasoftware.com	tcp
GB	143.244.38.136:443	spyhunter-download-v2.b-cdn.net	tcp
US	8.8.8.8:53	191.158.67.172.in-addr.arpa	udp
US	8.8.8.8:53	241.157.30.184.in-addr.arpa	udp
US	8.8.8.8:53	26.28.244.18.in-addr.arpa	udp
US	8.8.8.8:53	136.38.244.143.in-addr.arpa	udp
NL	185.26.182.112:443	net.geo.opera.com	tcp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	192.178.49.163:443	beacons.gcp.gvt2.com	udp
GB	142.250.200.14:443	google.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
GB	142.250.179.227:443	ssl.gstatic.com	udp
US	104.16.149.130:443	flow.lavasoft.com	tcp
US	104.16.213.94:443	sdl.adaware.com	tcp
US	104.16.213.94:443	sdl.adaware.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
FR	52.222.149.94:443	webcf.quickdriverupdater.com	tcp
US	104.208.16.0:443	cu1pehnswad01.servicebus.windows.net	tcp
US	44.231.65.137:443	apis.mosaic.analytics.awscommon.mcafee.com	tcp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	52.36.122.185:443	analytics.apis.mcafee.com	tcp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
BE	104.68.84.174:443	home.mcafee.com	tcp
BE	104.68.84.174:443	home.mcafee.com	tcp
US	52.32.197.40:443	analytics.apis.mcafee.com	tcp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	8.8.8.8:53	233.38.18.104.in-addr.arpa	udp
GB	23.73.139.48:443	sadownload.mcafee.com	tcp
US	154.27.69.81:80	cf.quickdriverupdater.com	tcp
US	8.8.8.8:53	81.69.27.154.in-addr.arpa	udp

Files

\??\pipe\crashpad_4172_MKDKTNRSDFJNQNAR

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	2c8859394b83451950f38b4689c542d5
SHA1	0de71d0fa454a9ca36e139d6d2a7052be9499b8e
SHA256	b242921790e246691d2b03fe5ab1555c28ca5abefbecf64d46624c5afd482dd8
SHA512	07ef021b253fedfc850fa980ff94fde4a9596fb3e82ca163911edb3cc05386ed2dc8904c3470016797ad589f037ec183b2089107e5f911edf1b5a3a7efb983b3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	b7228d01f69368b46b9e25614c500615
SHA1	1f95850437479133c136e59b7794d36d8918cd91
SHA256	d2b9f1d6fc5b194bff46a986751b976e5ae6eea65de63da87fe923547a94b115
SHA512	4f65af3cba9b10c3ae6d007f9a19980ff2f00cb63d04f5d7a0d6137ad7ee0757ed3a05f1e6be31e7d63aa2d78fe46ec9a701a238f91df99d74333748dcd9fd22

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	f5af8ea375ccdc424ece4c7ff74ea1c1
SHA1	af523e05f40626b5adcc85e78e2e1359512dca00
SHA256	07e7924430794409f024cf231f60f5cfedf2397c259d275237130a4d55d92fa8
SHA512	cfa8f11a25d701ed4bf675b18ea0064d22d91554ef23263957425c10ec7ba846b136780e93800bd04903609fc07a1241d13e0096e88fa2269f131bed2e8af7fe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	39dad8ce2c075b2994ba7b81677dc5dd
SHA1	91bfbd3d07f24c694752cd4db6ad571fea231d6f
SHA256	c097c4eecfbdb0237933793cfc1a0f01eb6484fe908284d7d55f832a1e6fa04f
SHA512	9b9c1c454b939830b32e3c0a36e8308b2453f8a61903dff7b913464ca631bd9e10bcc1b32d7e93fbefbe51ae262608098eb1aa7210ea83c3e183734d58c12bc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	aa1ab2e6fb8f9c5bed6c38fb6842af04
SHA1	b5e56ac925d3d9cfc73bd02ba852b3fb1fc1ded7
SHA256	d2e24c86290bd1d80d6fd3afc747f8ac82da5af2d2a08f4c75dd9c7f73d7829a
SHA512	a19f31b32bb58aee45e15032b5af47cc0778ab046648414321548c64567d55a4fdddd3b35e82a9f1950cc83bd916a6669bb37c3945e16fe9d0e078bb1ca3086e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	380d1e9d877d0e28e9b153d344bdd47f
SHA1	1f955e9c0eb1d84863ad35c1ab0689c87289f3d1
SHA256	275f07ac4199faaeacf38d2a28f0887f66209d1c8d6769a282614f62c26fd577
SHA512	8298770690e5473321a8d3ae19c074545b46e53cc69bfc56aa3ca7df91b07631b074335508a1c6e079c4dfb38d9627f55e12d166b2810fe2e973193192129190

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	52ab7073652112a8831c2f697bcf77b6
SHA1	4abd3e72ab6e3a4b0502b427ac4d91581a445335
SHA256	1f5ec12667341393016246696722e9ffe97fa1e828616e82b7052542696a4367
SHA512	d89efdaa9ce8421b03ca601aca798b69e8e91418c6a68d15b7f1e986683f854a98826fd0767e0391ca4f5bf49fb53a7eecbd9a8911e6f8e4817238fa61867e20

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5865d9.TMP

MD5	856052fce9e8bbb4c4a59dab384291a2
SHA1	bb69999bca63b73c9fa4c8eb122fcba400483c48
SHA256	0bf73a14ed292d9d63dc10e177f7c3ebe7055339d451a5315da6d06c5e95dc74
SHA512	d6993a226966b67adcd40ceb167852a65fe4cfec9ffa1befbf129e12a314afc0066bddf272e01fa1a733fa1be606f4e40334a6d0cb849bb08c14a070024bfa38

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	b4b027b9035913f50826111c861aaa97
SHA1	f0f6e5d6c0023f8d2ef8007c70a43daa54c6e79a
SHA256	999ac14f1b6e1ba53838f62bc3429c8346ce00aee94480b80a5c4b52097a5d3f
SHA512	54b7b8ffd1fab3620ee284474be8c90843335e6ece6a3b87400aa39f85b4b6e31b7651d07fa8c9231377dc09ac906b96e145817d98facc8c160c8e42ac550132

C:\Users\Admin\Downloads\JDownloaderSetup.exe:Zone.Identifier

MD5	fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1	d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256	eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512	aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\Downloads\JDownloaderSetup.exe

MD5	c3c3b50075bd5c87cf500c255dd833fd
SHA1	0b3593f15ebc8424919857d08d016b2cda2b5161
SHA256	a43fa3db0a053119f73a7422453e54318a258a947e8c0fda294b09c52b7459fc
SHA512	f9bd8c26a63b3d7cf6d6f0686a93720f9d3007ae2f196bf195815761b5a38f9fb81f2de6400abd842cc634ab68a14db6741436295a0d667e0b51099dbaf13c9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	fb05a8201239598585cd34641a4c424f
SHA1	4fea96fbe792fb8f5f33c43b3a9ead5c55b13b2f
SHA256	888e93043df4038f5979a15b8d5a15c7a17fc02e71d86972831e5fb47906d1f6
SHA512	1ed96728ae62355ca44d7d9c14069817aa1f32cd897600710c78a6447b818232fe2426b4d0c4642f6af68a289d8f6ef80abfa283a2a68449a79d8aade3db3d58

memory/2356-185-0x0000000075160000-0x0000000075911000-memory.dmp

memory/2356-186-0x00000000004C0000-0x000000000230E000-memory.dmp

memory/2356-187-0x0000000006D20000-0x0000000006D30000-memory.dmp

memory/2356-188-0x0000000006D30000-0x0000000007114000-memory.dmp

memory/2356-189-0x0000000004670000-0x0000000004678000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\ServiceHide.dll

MD5	ceb35d7cf1620eb138a71c23059ff910
SHA1	6c1ebbfbbc30c8fc02c9742131115d4f760d2ee8
SHA256	b551b3066022b08e7da70e9bd191e691f8a26628633bd8524837319201ebd0e9
SHA512	dc8847c712f0071ec1d3982e05eb5d79cad22484b8e9e1c3c644607fb8d3f08b00b9b94aaadd84d3bed8e802c677df5a090e08589fef8c3fc246a5cb3ee2d813

memory/2356-213-0x0000000007150000-0x0000000007182000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\OfferSDK.dll

MD5	dc6d53b383ae4a1389ec23e676afb866
SHA1	0bf4672988a05e292b99000ba5bcc805c1b16d0b
SHA256	49ee3c4bd541bb0f930ca8743aa72063b182db59548254354b0ccc5276295826
SHA512	8f4af4f5384a541e32a27e4489aeb75bd8d9002486ceb281acd62e592f9a3494d85622293b98d7bb5da9cf9f5803873db2bfe2431bfe7f6c9a516c091089367c

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\msvcp140.dll

MD5	8ff1898897f3f4391803c7253366a87b
SHA1	9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA256	51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512	cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\vcruntime140.dll

MD5	1a84957b6e681fca057160cd04e26b27
SHA1	8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256	9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512	5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

memory/2356-221-0x00000000072D0000-0x00000000072D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OViewModels.dll

MD5	74d840d8263deaa875ce9bf40861625d
SHA1	876d6d704e61856f7a4625d13e23254d42383464
SHA256	cd201abf119a063673da03e9fe81e4157031993d3f6776ef0afe9c070600d242
SHA512	a350612516b364a6f1eed2ea4289b1c68d4aee9e4160811f4537e270307e8e25c0ddfdaba9725913a5dd6fb179483247bad4f4c6cb19db2cca8b2da356854bd3

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\SciterWrapper.dll

MD5	f9ccf333b9891dcc26c780593f706227
SHA1	159e902ef413c6a7e2a668913c3a7c52ff4833da
SHA256	ec5c5e6dabbf9a9cfeef6bb6c5e842c3ee0d5906224b7c30610f736a791ae3dc
SHA512	94214410d1b9ff7782abb6efce794ce3f51af2512686055a27dd5875bf34c7b1610ae5fef60f197c8c46259d930eb17ebd887f7b92b01f1182ca266735e1af7e

memory/2356-229-0x0000000007310000-0x000000000733A000-memory.dmp

memory/2356-237-0x0000000007340000-0x0000000007368000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Ninject.dll

MD5	8db691813a26e7d0f1db5e2f4d0d05e3
SHA1	7c7a33553dd0b50b78bf0ca6974c77088da253eb
SHA256	3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701
SHA512	d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OModels.dll

MD5	7a4ddb62db0d21cea4ab724e4ad732fd
SHA1	4cdbfac30ac141b6db788c4e4a9eed680ba5ad21
SHA256	41547db61fc5e43e0557ceb44670cbc40ea373feb9e7808fa357fded36d7748d
SHA512	523fe5f4729b06942c252db908d01c48261ce7224995e4d361f4084321893459850aef8ddd18a25474d3685fdf512dfe2f583c0fb749861cf744df1cc46cf440

memory/2356-245-0x0000000007390000-0x00000000073AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OServices.dll

MD5	45631ab991cd733c675a5d0abcea00e8
SHA1	acad2f57465173b823541c05588f018559dcf2e7
SHA256	21a2bb14ce7a73a1ab28f0178e9c9a3a8add4d893a3934b465f812d8d541155c
SHA512	5262134ec99aae19f339d8fa814b583f6f407a84d1edfc6844b06f1907b32ccf29a878adc171392b6d7b49d788aa5c0de7b667be65bc950d86ea1be04184b0e8

memory/2356-253-0x00000000073E0000-0x0000000007410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OUtilities.dll

MD5	e0ffb8f465efc031de785b841564b1fd
SHA1	ad8a16e081032d4523ea3e84429f07e3aaf7feef
SHA256	1da093c90f1ef01776b506b151ea2b525155344a337b057d1c04665ce1d12de1
SHA512	6fa34f9b1e76fd18f3d136d55cf2f2d652756831fbb67db7d4cc2224892483a6b621e7bb4c925db43ab8e999727ed9dda37360358628adb904d4979456b153ac

memory/2356-261-0x0000000007410000-0x0000000007436000-memory.dmp

memory/2356-275-0x0000000007380000-0x000000000738A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2ODAL.dll

MD5	4f54b457229815dfa6174eecb2cd639b
SHA1	401d38258e91c9c3a8d5a5ac5cbc6b2e861301de
SHA256	7d3013499d2ec43a6b377ae7ab563248ebcfc09a8f0e4a6bd6a0043292010873
SHA512	fb4373b8f6dd5acc88c3cbb10116f394b5ce7bec078ed04da633c620b0e84ac6cfbfc03ad18b335ceb7e43adfc36e0c7eb19920788fa117f6f0d366e0ccb5ffb

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\HtmlAgilityPack.dll

MD5	17220f65bd242b6a491423d5bb7940c1
SHA1	a33fabf2b788e80f0f7f84524fe3ed9b797be7ad
SHA256	23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f
SHA512	bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e

memory/2356-286-0x00000000074B0000-0x00000000074DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\ServiceHide.Net.dll

MD5	f534c11d6a35477b069e3fe23b004394
SHA1	1e13a0cbbfd33ee4174f2289c9549967c2a28ad2
SHA256	28dd9b9fc9d950fc9c5d27bcdb78aa76803ca7aa8dae8311f8e51700b9bb3e21
SHA512	b64bcd1796396a4e443a2199ac8d294b6492798dd2c56d067705a673661d8bc7b3b4337cea9000bbc188c9b82969ebfce412af1d071315228f6a50c2dfe915dd

memory/2356-296-0x0000000007480000-0x000000000749D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\MyDownloader.Core.dll

MD5	f931e960cc4ed0d2f392376525ff44db
SHA1	1895aaa8f5b8314d8a4c5938d1405775d3837109
SHA256	1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870
SHA512	7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

memory/2356-313-0x0000000007A30000-0x0000000007A42000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF360AACB1570042DEFBC833317997D0_A0EDCAE07BFD780B2D4065C5AF031F1D

MD5	7ca40213f0ef2d8ee9c74f227f1e4e57
SHA1	d0a8f61dc3a55bc6daa7264dd66a5d891a0bc508
SHA256	c375fd1b9913a3a9025728212d3413ed940c3468abf3a478ecd4f0555d2dc78a
SHA512	4629441d21662678207d1bc682ab779b4022f2b2d04b48f18c66705efe78b0d0b0e007b72d17a4d32496f4de77d289e82616a53cd5a31b0fb20be974855bc3b2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AF360AACB1570042DEFBC833317997D0_A0EDCAE07BFD780B2D4065C5AF031F1D

MD5	70bef265f41650e0e004df0e8ef02ec6
SHA1	badb0b60634a1383e54177193bd6f3ee936fb837
SHA256	6fb72076d6394f7a14bbbbcd9a3a42ef375ba38b41c68f06608d8b7dbc684fe6
SHA512	bc5e97234652a64ab229dd7a55b55db5ef8c446b6d3242f64ca8b052cf5fa77ee00181e9cb64c19c0d88aa135a39dad714fe18c2ffe3361278042d725348fd93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF

MD5	ec95ba152315371a12b61e59736ef2af
SHA1	5420ca8697ddefc184f61745f4737305a68a4e75
SHA256	55c56ef40fb19a4cf6d03acd5c5232286fe429d79e0f619701f32d51a5428198
SHA512	ecb8c92181c02083b06272b5d92acbbc51abcd3eee7e42e06d8df77fb2e4240d5fd2f5a1a084dc9c4f7945218fadc1f6a4532145c12dbc1887961cee79f19be9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF

MD5	1278512ca0ac625d3646442f8e9306cf
SHA1	72b5614fe02975c01885376a1c4d40b766fa4c4d
SHA256	66465ec17f07145e4a6b84b139d0ff6f7fc71003460f1b8a53ecadc8b6a79f94
SHA512	e277781aecf1f4279d30ceb4e751baf4022dc19d8eedf7722e2afbb347b58dd3106d227d4f1a35f9e156d7b83e06953a8f4bc0b99c65dc62d6680d970c5caba2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D

MD5	4abe6a1a6dd562560ce6c6f9def6b616
SHA1	9d5f13e1f70540b670d20443317d71b624fbcf12
SHA256	4158d48ed4d7305d0dc18f456a41e9266ed83998243ca367904900b729045984
SHA512	32ae7cf64c5eda7b92eed95b91c37e56a4700d6c09efd184fdcb96cedd779f35414ce2cf2aff5139306f340d1e3e181b249634b9627aa58db7d877b5521c531c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D

MD5	e397c1644d197f3ff8948d5c8661cc74
SHA1	8f1bc7b739f9e52c3a61f962bfb7776f9fa35ae5
SHA256	54bffb0fe82062e63ee4d3a9cfe27a750b975c97e4d41e22af67fc7cc42e43a0
SHA512	bd6ddc45c4e49e919c0bb400822c78ac07e7788bc4eabaddde134786514b72f6816d38603e475b46189f0662bf146652d03770e8574217b543e7b22237ff09f0

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Newtonsoft.Json.dll

MD5	9de86cdf74a30602d6baa7affc8c4a0f
SHA1	9c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA256	56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
SHA512	dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641

memory/2356-329-0x00000000080E0000-0x000000000816C000-memory.dmp

memory/2356-334-0x000000000C750000-0x000000000E31C000-memory.dmp

memory/2356-335-0x0000000008060000-0x0000000008082000-memory.dmp

memory/2356-336-0x000000000E320000-0x000000000E677000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OResources.dll

MD5	cfb06ff92b4bbbb61eb9fea6b9a866ee
SHA1	5998200da6c043a82d3f7b37e4770bad80f2787e
SHA256	da79b3c64ddf384b3d6c1864c3dd3bad1973f53db14db6623e360e41156ab796
SHA512	58197170fad4d931cf3f55b376d1c14d8c86a28a86c7141a0b1faf34025928a28444617565b0924250f6193104cd1b02501ec0ae438083336624fa3d41585525

memory/2356-342-0x000000000A2D0000-0x000000000A2DC000-memory.dmp

memory/2356-345-0x000000000EC30000-0x000000000F1D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\H2OCommonResources.dll

MD5	412ba91898313a54cf7db18b0e9e610d
SHA1	f1d893e079cd4599fbf0c862df337476c42be91b
SHA256	31640fb6e193a987986c6b655110189d8e30408b00234c955158973ec9e97b71
SHA512	8dd0e3e8ebe43379c5002f6133c49e509964b26fea8c46ed8dfc2687211c6d3a000cfc04edd2dd9d34df03400b5640f5172fa22913d65a784be191aa995ea558

memory/2356-351-0x000000000F7A0000-0x000000000FD54000-memory.dmp

memory/2356-361-0x000000000E8B0000-0x000000000E942000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\sciter32.dll

MD5	b431083586e39d018e19880ad1a5ce8f
SHA1	3bbf957ab534d845d485a8698accc0a40b63cedd
SHA256	b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b
SHA512	7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	9913be8a3b4574deaaec5d53f3378b0d
SHA1	a787ff6e2f4dd702173de2c73cd54e0732b54724
SHA256	7122122248f83d3311640abb7364e29a5fe1462b23c3e78f579e8c676f7f52c4
SHA512	26506789f5f80383b36440c309288399f85e0a8de2c608a4eea75d308285bc2153580d513a64331f5a3ef62f0eee0f7ed94a813bc8572f454ceca21ec1528909

memory/2356-394-0x000000000F760000-0x000000000F78E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\MyDownloader.Extension.dll

MD5	28f1996059e79df241388bd9f89cf0b1
SHA1	6ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256	c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA512	9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\Config.tis

MD5	bf5328e51e8ab1211c509b5a65ab9972
SHA1	480dfb920e926d81bce67113576781815fbd1ea4
SHA256	98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b
SHA512	92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\app.ico

MD5	1f0fa25c629e147a347578677ef48c43
SHA1	55067928730e6781b657f26242c13ccc843c06ea
SHA256	ca4422f74242954350de35efa9db4f92ff748ad278b56cecf02c0ca9192460f2
SHA512	baa962508eb3c5c1277f01f25e68b10017d2e0d7dfe876253d54497aa6e9bd6f2f1b4d88fc82bea962e4c252654fcbaf3c12a07e2097dd57ea62aa9aa192f80a

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\style.css

MD5	362fa1bf3819e45f44dea23764464801
SHA1	6ac9c0b66e3dcae13d04fe55467e06b98f245081
SHA256	676c33de0bcd9869319dcde8158da5cd4b49499240592bf6b95122068b23bb11
SHA512	34403c23927be775e96bf57a6ce702af8109cffb26608f5a49cd7e3cabbad358da30a0eaa36927cc7a9f01d61ba5f720ccf41c1f9dc5a97f1de940e83637fdca

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\EventHandler.tis

MD5	1116d7747130f4552a91e61a3a6000b1
SHA1	bc36996a664dab24b941ec263679c9d6322e61a2
SHA256	5c09c6784f3fdc4a6b2998c4c9e02e366265ee5314c0f982859825576dc0eafd
SHA512	af34413f242b64737ac9f7076e449b0d0485842d653d1cad12b54b868f09817d3595cd935ad7e03003d536127c173d624dd9a031c079fdb8f897ab0b7b9474e8

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\ViewStateLoader.tis

MD5	85c33c8207f5fcb2d31c7ce7322771ac
SHA1	6b64f919e6b731447b9add9221b3b7570de25061
SHA256	940ef5e9f28da759fbf3676fba6da5cc4199b78ffc4fefe078ab11d53e70fb0a
SHA512	904188ab57cfb4f3d8c51eb55746ae2589852f271b9fa3840b82bda93f69c9f985e65f67169302d08818b707f36246f83f245470d5175dba5f0ad3a2482740c4

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\Log.tis

MD5	cef7a21acf607d44e160eac5a21bdf67
SHA1	f24f674250a381d6bf09df16d00dbf617354d315
SHA256	73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
SHA512	5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\tis\TranslateOfferTemplate.tis

MD5	551029a3e046c5ed6390cc85f632a689
SHA1	b4bd706f753db6ba3c13551099d4eef55f65b057
SHA256	7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
SHA512	22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Resources\OfferPage.html

MD5	7c9ba4307c8fa852cdc21898f0638980
SHA1	5f5b065c46aa8a629f95db2e4e47c5c5435c4622
SHA256	c8a08eada415de5cfe32d174d78ffd8750cc9336be8f5688d87c8cda6d2ce7a1
SHA512	fbbba6ecdefb39376e5c71439323b38f20ec47cc6c633d69da5440609b4dd545a8fcb2ffa9998b6c99ed4baa55c42496cc212058c8bbca99c4b9b6eca6278a56

memory/2356-465-0x0000000075160000-0x0000000075911000-memory.dmp

memory/2356-471-0x0000000006D20000-0x0000000006D30000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	0f8f95abc0580f5ad32a54a24906c2ed
SHA1	f8586cfbc48b9d30a605a4a848edd59b1b0a7b31
SHA256	7354663320829a6334ad0d14e463556f4e84f18540f64890375f7c9cc075cee0
SHA512	e03056aac0ee44794c327f4c29a6a1e5692a44b4003c13f0b1a1022852607419550c5be4ee5762ff36065cf562e2b1c3b2b298f6cc68187a26e3df2f31249441

C:\Users\Admin\AppData\Local\Temp\5f3bf50163bb4e257419f910f803d8b2\Carrier.exe

MD5	a7bea54cc86e33386a7aeec02ef77100
SHA1	78059909f44c36933de0054b9f19b4fd09b8ca02
SHA256	21a096298cbc3189ce0462d07ae3bb7192794c7c77931db835b4936d25d315a7
SHA512	74ef995bf6f3f164b5981b0cf284862ad458139485341d93cd791901fa965a35c53a362db94c098c4baad9188426ffebd2e8c6dfc5b662c4b5af3540b27f9822

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	59b5ffa3a3484bf16807cd7850a7260e
SHA1	6ae52a3c2c9406dc1029b72b94a63cd8c5da5564
SHA256	4410572ed3f1cfed2c563241318e80699baa35f04a4ca2a68629e92a74c39781
SHA512	2a33951a7328cc7694036531c6f230ececdbc3786de9a60d2187e95a076ff6f035d9478e8fd15078da3c46cb839f4e6aece75140767f472b108f18fbb09c77ba

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	3ceecdcb0834b479439367eef68e10a6
SHA1	323da506a5cc297c99fd964e47c7d9c7ac652447
SHA256	1a2f16ca310d5ea677bee274f1545710768c9aab58a936fb633a28b537545020
SHA512	f71c990056db9b1c7ddf0b510305e7cab9ab5216012502efb8bdfa35deadf9378923e86bd4966d3d1036cb439fbdd1818ad58e07d3e6bfd73ecbf82af328cc54

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	d35b2857f62f7354d8764628e2197f7e
SHA1	a481f4509c7fa7e37d3b1a252e31a42b7b082c01
SHA256	a1a5cc3121048f5470e1b0ddac73fdf233420f6376257f06f90d72e5652e641e
SHA512	f6f4f49c08b5d8148c80b113df2c0ea959ac58dccb73de9d71cc56138e95123df95f5c29cfa63b1c9b305a6dbb0ff3275701f5f45849b5ac84984487c17cecbf

C:\Users\Admin\AppData\Local\Temp\i4j_nlog_1.log

MD5	885c0fac62f33dcbbf72041170972a01
SHA1	659533483ac3d7726024e64b81ce7ef9a2eafa02
SHA256	777747fc0a58a3dea409b9304a474269c4dd0cb499a3952848d97046a7f682ef
SHA512	eaf308abc78ad7d2dee0f115d7c31ceafdfadbc44b4a51a8b8047cfaf6372a44741ce1f1e4d64d7b94e49476885c78cb1a5543f48571a85b4dce6efe7a77c592

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\unpack200.exe

MD5	8a7e94d3c3c2306ade5f2ea359cd46c3
SHA1	18c4a4549d990438ba734c4f7c3a4ef795e4297c
SHA256	09147c13d553dc415af12deadcaa9f11c042b7b94ada6479cf2b598a2cc2db0b
SHA512	220592f6af2ce1dcfedd0d29195d066508ca097604a2198f52d9a32b8d85e0953d62768c02922ac2a898fc410e6b7b9d80d870660ce602245182cc5f63cdbad8

memory/8-1283-0x0000000002EB0000-0x0000000004EB0000-memory.dmp

memory/8-1294-0x0000000002EB0000-0x0000000004EB0000-memory.dmp

memory/8-1303-0x0000000002EB0000-0x0000000004EB0000-memory.dmp

memory/8-1304-0x0000000002E90000-0x0000000002E91000-memory.dmp

memory/8-1305-0x0000000002EE8000-0x0000000002EF0000-memory.dmp

memory/8-1306-0x0000000002F50000-0x0000000002F58000-memory.dmp

memory/8-1378-0x0000000002EB0000-0x0000000004EB0000-memory.dmp

memory/4524-1385-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1398-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1408-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1448-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1452-0x0000000002850000-0x0000000002851000-memory.dmp

memory/4524-1462-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1467-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1468-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1469-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1470-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1473-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1479-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1482-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1487-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1490-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1492-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1493-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1494-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1495-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1497-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1499-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1500-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1502-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1503-0x00000000028D0000-0x00000000048D0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	ddf039971fd44f02b084d2bc9c0f0e2d
SHA1	dbbc6933d6de2f18af3bf9522710845ca3c0fb60
SHA256	5cd761525454249e5ef6780b5d4367fdb9c346cc8217a5675c46a34929e274a0
SHA512	4f0ec76ba6ff45462b488a81377d539d15d6f9ef705d8be32940062ccb09722f5e21e776ef5e9cdcc4669a00b25a407a31c98381b0d3ce4647b1d39c2043703a

memory/4524-1513-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1517-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1528-0x0000000002850000-0x0000000002851000-memory.dmp

memory/4524-1529-0x0000000002850000-0x0000000002851000-memory.dmp

memory/4524-1532-0x0000000002850000-0x0000000002851000-memory.dmp

memory/4524-1571-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1574-0x0000000002850000-0x0000000002851000-memory.dmp

memory/4524-1587-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1614-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1619-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1627-0x00000000028D0000-0x00000000048D0000-memory.dmp

memory/4524-1633-0x00000000028D0000-0x00000000048D0000-memory.dmp

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\ASSEMBLY_EXCEPTION

MD5	d94f7c92ff61c5d3f8e9433f76e39f74
SHA1	7a9b074ca8d783dbe5310ecc22f5538b65cc918e
SHA256	a44eb7b5caf5534c6ef536b21edb40b4d6babf91bf97d9d45596868618b2c6fb
SHA512	d4044f6ceb094753075036920c0669631f4d3c13203caf2bea345e2cc4094905719732010bbe1cae97bc78743aa6def7c2aa33f3e8fca9971f2ca0457837d3b0

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\awt.dll

MD5	6a82eee0fc77c35ad3a0a6f534477cfb
SHA1	39b92eae378b8661b81ceedc94266b994f57709c
SHA256	92efcffa5247b0a039ac3900a3d058d58d597db7f895d3d05d3b6243cbfdb1b2
SHA512	2bcfab5ae496f6668c68294ec9d4916a1efd392a5ee9cf6a8ba1ff49aaa2a935c93c880e02c8d3ec6d17ca32a2564c71403e3dc86c2e9f5f667b7bae1eabb99b

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\attach.dll

MD5	b56af8a274e83897522dedbd068d27c5
SHA1	71803a464b6ef7ee3b4d9b1fa7022b5415778577
SHA256	2fc62b3a9a707c8d26acca8aec6b764ee9360798eb6f7f1724c6d754cb4c82be
SHA512	7093d54fbcf7c157210201dace7a3059cac0a6fa4a325e07efeb8f35b7cb515d04bbc61f36242db2d5cbd5db130a125107175392f6677f7d89ded00bbe1ae945

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\client\jvm.dll

MD5	26e8f4be912ba6227a3ff9edd87622a0
SHA1	4500fee4a98635651e78c1aa3b7521093a5df561
SHA256	287e6de0c5fb6589c62c7d3807f5d5a79f7d4fa0326e3e90b41bd5b52c14bf12
SHA512	d79fd3252c5fac291ac9dbb4dd003ee665bc16bb4697f9442ca07cb9359f3d72fda47847dde611aee343747abcf0b7bc1cdc8cb7856c1883d88af94d6f345379

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\client\i4j457715366931156075.tmp

MD5	b3174769a9e9e654812315468ae9c5fa
SHA1	238b369dfc7eb8f0dc6a85cdd080ed4b78388ca8
SHA256	37cf4e6cdc4357cebb0ec8108d5cb0ad42611f675b926c819ae03b74ce990a08
SHA512	0815ca93c8cf762468de668ad7f0eb0bdd3802dcaa42d55f2fb57a4ae23d9b9e2fe148898a28fe22c846a4fcdf1ee5190e74bcdabf206f73da2de644ea62a5d3

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\dt_shmem.dll

MD5	13431dddfa6ac7a6f5e15c3ebbe76b28
SHA1	d60e8f85b61658b8b6751a1068e2656e43aa3293
SHA256	58ddd0928bb65c054c4fc7e5d75df25c345d336393bab4a6f8fa3c2d46774572
SHA512	6add51f6fdf97e3052d0fb1e5735cb62f7cc9eba8455ecc2fbbb52cbce278711640a01a7bb0b8b22b1bd2daa92e83dab69231f38df21701a9bacd3c6a51d57c1

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\dt_socket.dll

MD5	291d3ce1e405c26fed6cff9cc4972c5d
SHA1	8b203b03dedeb5322aa17580ec5f970bf7a5aa86
SHA256	e4b1fbbbf6e2e38fa0bf00968ce0be1cfb23e757976997dd8bdec8287cebd16d
SHA512	ac60a43e00db953749aace7de5ed59f0764fa758f48b54f807b358fda9fd3eaa60b0492355a6c75efcd3268fbf135833d30ae43cc0065b7ae4ec8f9eeb00c01a

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\bin\freetype.dll

MD5	7258964c0b49277fa5a9458401358a30
SHA1	f94cb4a408f12aec6fb5beca543404ebc8237ce5
SHA256	23251630069479a92cd9057d138d1a28f52afed905adf04bf7339fef6493c6a4
SHA512	beb9023222601f83c84b434ab8ee6742aba0d1d6f96f7d232b8608bfea2a1e356cc0a143904b7959f4ea901441ef134b35a25b4a3f990eef041d574ff12e9217

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\hprof.dll

MD5	a89dae341c043e02c59432484e3216de
SHA1	08d4d946e8ad0850cd62716db2a586420f985223
SHA256	a3b9c1cb32f39db7b446c061e4924b386b1d3823301009a469dc8c0289e14389
SHA512	850b67e1890aa51cd38103634a1d7780d96b854a92a128945f4d0cfb817cf2910cb2e0f50e8ec6d255662c448cdc249e98b4967d1ead3ffd74c74b8cd718f174

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\java-rmi.exe

MD5	58d16419656220490df334e0fba3c39e
SHA1	5f4d7a299d7a6225b9cacf8480ad83354f4461fd
SHA256	ac78f56c2e145283c372011206a108e40d0531640d7e1e6d1184d5350ff88700
SHA512	c3e12041e22d02cb39799c64d838ff30811afdcc5aea35d037665bbbb18dc2c0f47c3446a6c2d7cc50278aa00989a8e7ab2913d6b21b33006b5cc1496b544a97

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\javaw.exe

MD5	f5c73c2a44847b039cd1138c705b0f14
SHA1	ff55f90265210ea6e5423815c476195f41c3ce10
SHA256	1d54d25f2bf8fdeb3ed4e172de543cc2de2c98e5835dbc74dc959b892ffa80f6
SHA512	6a5b96149b8c2c2c978facff128c76184dfb793e119b63953b418424baa32f63c8cc1bd3434877b51ede900d3ea110751e16a817890c671dc8bd6826bc03f300

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\JavaAccessBridge-32.dll

MD5	9ebf0088ca46367a963e1a881f7e369d
SHA1	c0988b127857d586acfbd69d47f9da24ce8f453d
SHA256	0e0d4945951ca83bd55c123d6c39f3c6e4894a4230173cf86fd0856397b4ee21
SHA512	973215895deae01f423c84b8e053b9a1ddfcf818b4e206bfbf0026db230f6101c304a8fbd81ca12cf2829178adc3fb907255dec41c72ac3a2f9da3b723796b51

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\java.exe

MD5	9d731f92f6fd99721e1daf608ca7892d
SHA1	c5daed31d3b262d85f2d58a4ac666d5465e2cded
SHA256	859321842045f5d7829843a0238d712b656a26a9e4b652d5da1336049edb05cc
SHA512	ad00e2fae175971163df831464b7ee91d4dfc4b2731d8bc97081c32cb2f6c0b090766fecaf4aeb276ce1efe9855f46f0dad64c8649e3f7ed59fc37c6ab416e0a

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\JAWTAccessBridge.dll

MD5	5d5a9b20ebc79af57654ac99790e645b
SHA1	b051d35f825abef0f9c4e3e48787e22caa0dd6b4
SHA256	53e1f3e607364f3efaca3f5fefab1f3a4ea6281701ebe3364b3f4d80c6f57625
SHA512	107e5596b562aac1914ba1d0bb38377c2678475b7ea8877244cf6d12568e9f1e942c47f572bacb9036632df939df235469a119a729930cd1ab62cd7b9e316afb

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jli.dll

MD5	85a07ea04775c06b097afb06b1225fce
SHA1	06a6ad876aa6da694908378f3c5a50e67b3b8017
SHA256	9fca342a226e9812cb6327eea913688cd2a57056ef4ec197fd8e951cd6a7a859
SHA512	2397485b4603eaf6f726c5d5330d18bde12875914cf00d4f10e91c1caf0fbc7f630c0f457ebb8b0ae6af802fe91133ca1d6e0787cbb2de1131c9285d9cfb5ec2

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\i4j6535352831441061945.tmp

MD5	a0461348ae1b8ad6dfdcb946a16208c3
SHA1	35ba83948c880703281515c78b10a7846aaf7934
SHA256	35c5ff7761a658d5be784c1495a9fba299c1f5a2e5e4b4cedb74db65003427ff
SHA512	b2b26ce6a43f5f8a2219911bb435835273b37bb763d64d6062a34d3ab92080d4d5912845a01c947100c3537be9338180b39fd2b864fb70ed8c1d86dd5474a559

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\lcms.dll

MD5	9aeddb1db12ea7330247496feba11786
SHA1	f86412046be1872a52a72b7ffbc5d0600e08f189
SHA256	34c3efa9698fdb54780684d288a800a8c2158a4270bc5812e05b6785e62468c3
SHA512	86bab6a4a883216cfe4b9068a5aacc5304fafac8ef9b8a3f1d1e451d10616f512b0e50ff6352e983a00bbc8c62c45ad95c38b561b10fad66282713294737b785

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\ktab.exe

MD5	5a669e556084e743920626257ec46d0d
SHA1	014869f41f4deb5cde1afd1d6f9425c259937d5b
SHA256	5b8fb3e559a076f221531b107e752618f3e09176559c4324d563727a6600b3f3
SHA512	ea64a1da0e2dcbd68c2cea946d9ecb866fcf10080b5e97226cf637a3219066433313003d593b3a5e44c744642e2e0a3cb2dc7b42cd17a2ed15ca7cdc15dc0410

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\klist.exe

MD5	c99cfe4325992a698bd93ed1c3e1a163
SHA1	58f7d8ef7b67c7025cd6e9f3fcecb22413452fd6
SHA256	7115f961de6f925231e6c7a1cf8e5b8b48194268c6fabb52ae9d926096ce312c
SHA512	ecadf0c1397b6babd734e4c8f186563ec85c18d9ad90e24a67651158ee409a4c19cb95f959fc069a5af7a352977282186e769fe35aa06cb39a1e511aad93e44e

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\kinit.exe

MD5	aa78d57d51127c28a65616d74369e46b
SHA1	01ea3b9be7753413d5d0f77652c0c196f76dbd2c
SHA256	d77589bab670a98268f7d8430ed88c9ee09b16c88f9c340b88a97f38b7a1834f
SHA512	ce896b8cacc1017c89f762ef7ea0930d6640fec108e237f5ccfadc377df5ed0f78e70d44653ee8cb8eb8489ab1611d68bef354d3dabe6ad6e57d17ad3e373d5a

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\keytool.exe

MD5	83f37c85bc3aaf8d5cca9f0febaa876a
SHA1	8d4fc0f08b3c00260a7ac85e1ff16b6d174feb06
SHA256	6a571777610de423ea860a9c81f13338df7ef834e70f005e9ef4c904356ecd39
SHA512	d7be1536c5055b2b64d9d76d8ab13214ae04a96d52b1226f49de63b8391daf90d421acd75ca6044257fc8924a00bf31786b3452db1c6270d57c09e5e20bd898a

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jsoundds.dll

MD5	0e814df70cfc013c1dd5f1cc78f7802a
SHA1	bb51b28ef8e9e5aef2be6a0a1723ca4a892835fd
SHA256	377ec05f8402597bdccb31ad4c51227a38e277ae17365d31b5971cbd13a55481
SHA512	6885e3449f90d85242e032599d996248292657e4c253409ccf87ba9857878c4dcbbe590221a08f59f5caa2edebce0c653f3dfbd04198062fee3622ed708b8747

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jsound.dll

MD5	a6f8d49a140428e0c0ac7f76cafe5429
SHA1	ef15873e4b2d41dbb63461cc259b3d81db9b5016
SHA256	add186c473ec420147c5f894c9100a03066f6091e79d6d50fe80704aeaa1af10
SHA512	61c500f50fc3a5c20e050a6451c7a8e20fe2d79d6d2196edc7e34e072891443e042cad4ac30fb9ba19c158ed15819ae6224df25662647c21f91f712ff4968692

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jsdt.dll

MD5	34d871102794620a3e6d17d8871d662d
SHA1	2c401c03104879c88ea16f3ff018ec03df13d562
SHA256	f123aa75c09deab118bf5f7275d717a9a47a62d09a08d75b2a3d6530a996f8c7
SHA512	9b53de0d954de7342b53659e7e3e3af2773cfee1b50c14719eaa4ba1e42e1b51ff6500820cf2aafe1078deda9058335e42d82a06190abb47f57c331b486dc104

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jpeg.dll

MD5	2a602b89cfbc538bf170307b7e46b86a
SHA1	bad7ce44a320abb8f280f774d07ca6df8ba9dee1
SHA256	28b89439983a07e6877bef5f8f7983c8a09464585db0dbf8f7ffd9db7d5dcdfe
SHA512	c99bb09adb459197a97d38ba656cc30670a1d9eb353ef5f0af0cd4b63a80eb05b42036b09c7d5421231c1486a5aea5b4a7ebb697b2faf70c9347571ba85fb398

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jjs.exe

MD5	fe4635ed39d1f047df14f63bc4652b08
SHA1	206fa3d1a9ec6e6931ab54cd954021673645fe89
SHA256	0d1cd81b3b37d01f435fa28807a4abe8e0e69f67435d0c896bc351b1121143a2
SHA512	05f8dcf1cbe52cf22b8dcb30771df18dcbf1885ba97302d7531fa36c7bbc3b6899427f3aada76e9fc52ccbe464d7d204b5a19186a05398678f071614553fa404

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jdwp.dll

MD5	2c596cf3d75fbf4061dbe15a4aa745d3
SHA1	9a22828197bd4f79a648d89a8043ddcbdd7d88ed
SHA256	f6058ce5ea97a9b5b764afb78b798cd67d6113734a4ccddd83cb8591ecbc6434
SHA512	d3e1f63c97b72d3d63745c6638fdff04350f08149fa6edd55bd6034d33cfd4bbcbcbf7ba5c94038aaad40aca2038f0ffb8454420bba2604e2c9d2cf32977980c

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\JAWTAccessBridge-32.dll

MD5	61fe247b8b364701cd52190ffba02c1e
SHA1	d498e0b0f4145fe17089124569be92714a1d8570
SHA256	48811cb5339b06b931f2b7b3c4dea0a2cd5a4220242ce2419bd9a07b0ddcfaa2
SHA512	832343692df4cc7ec75486832b3b1c899d56b6362162a4806d7f378a14289f228b84dc7ed513b8882f429d6288687bc3a88e12cb963a168f993bdd335a3506c8

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jawt.dll

MD5	313b2a7b9ecadaef9e26144992729de4
SHA1	69e53050004272103bc7480c3a7a81e2d61831c4
SHA256	333462abab21ea468ff0946aa1efe9cb810fbbd6e4d8d5d27c2f6d11b1eefa37
SHA512	9ec10b80e29512fed7c943138742630806a8bbe569e7b1af529420147edba595469cdbafb4d8822faa58d4ab63523489262784011ec32c7537f79864f36f3609

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\java_crw_demo.dll

MD5	80e2a1c2f9ac7aedfe89b0901a6e786f
SHA1	bac8187eacc1e306d9bfcc948304c02808f3661b
SHA256	6acd6ae76f689c51182050ae0413a125d9b6199c15c07134be6797c6b83c568e
SHA512	28aa059835156b02f92fa47d5fbef9a2965bd9deada48829c3d87e9aac2893e474cb6ba252107450ae8d2a4b51e4db865690491b35a8370e423d0c4b229c78bd

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\JavaAccessBridge.dll

MD5	c406d2742dbee7c09f288f8ca6c49159
SHA1	2482e4bc0d083858574ec5dd83925e9f752bad1e
SHA256	345e31c4f943d54241a844a22fe7a2182c309bb6e2eaa28bbd6762aee217f484
SHA512	4431cdab3bef3773470d48d2ef77ba12745401f70221bfa2bc5c4ac049832f72e5cc166e700f1a35aa622a00ad64d1dbf546555fb844ca6458b3c9ffb7e11a7a

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\java.dll

MD5	a5865bb68e184eb43c7faa1d19cf6728
SHA1	dd112a50b04085d557c9cc4051c48bde925715c6
SHA256	a473752cb4fc6c967e4bc4c3c8831ae1df84a1d8f34b8035c0d95b95bf996614
SHA512	d95f6e4456fbf533bcf52d4858d19655c3c2538aaf98485c2c105324502ae642946463cb7fe9aad890473605b4368b487ef39e86722cef27aec2845031262766

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jabswitch.exe

MD5	cb59aa985897a3f9ea08c3dfed3ed6e5
SHA1	7299cdbf6944f7c51767446e4b54230ccb537b64
SHA256	d2c4cf03ff8a181fd40ca04a3aaf0e8b2d0f7a9d18c4f6487f924719fe9e3a7b
SHA512	91e811f79a813a833c68d87a1c87041b1d88e2919d52d20ab5bbd9e57306f967f54ab61c513e75ee27395f1ee339d336d32204e944f39a8d6d96603651c9f8c4

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\jaas_nt.dll

MD5	d78c8560f8e96b062a543e03a5ae9c3c
SHA1	284bd7a500a889621bb2b84e40da264ca156d6f2
SHA256	e7d31f3c81ce8d7f24bb07e6ceddc2586181524502d1532291b816b0a86118bc
SHA512	81c57bd1dffe6b47ce810deb307f2585d11c6e1b08919f7782bb5962371781432613c4c383e1fd75d2686b81c1839134ab80d7460a4b945cd7463c34db937a80

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\j2pkcs11.dll

MD5	148e04f2505fcbc7d643e6282952964b
SHA1	90a9cd43f4148938fa95f456cc39c3aa5ca79a6d
SHA256	fc3cd6aef7560171d5fc7dd43a42cb0cd837691188801f0c9c84c47df39e8f86
SHA512	58c7d105f5a8353a5e817fe7c9bfe1b97b1fea30d4f4146d14886057cd7d005e71f7e085b44ae9d1c0d07a6351e593a47bc04270607ba272101bf3323598752c

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\j2pcsc.dll

MD5	40e4d92bc9092ce7368ade2779478d5c
SHA1	8247517100bf45b7f7909fe8b975828d7c7f0486
SHA256	e4b4e1e1c967d933c3e2c0574c0397f810220eaf4003de3f6d6683523f992af8
SHA512	de3938c5becda7cf43c19a36205b269cad23a73515a21921cb6fe5e0d14afcc6ce5fe913d6fc4123ffa81f1cc9b9f77a3d83aaa5087bcb06a6dddd8d90e95036

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\instrument.dll

MD5	68f64236adb80a83ad77ea685a3f7b0d
SHA1	1ae387c926daae203dade77d77c54a9b9218ebd1
SHA256	ac87090f7495625602e4a7f1524d2bb2083f9fa6afe2107e97ae500725c68522
SHA512	d4ff31af1e612fa3e9deea7c37d5014d3aca0d284cddb4dc5ccb689ea043ac07cec0215167e81fb780ae6f4c2edf4b277c01e0518a8d0092f0d442939e8ac4f5

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\i4j6990181950789629403.tmp

MD5	9a6af576e5752cac2ed0128bd7f1b41f
SHA1	ef7e00663bb8f18b83fccd5cfdd14895ff1c5bc0
SHA256	92420b8b235e3f43db5fb0434809c722973d4717e2d10483a5e69c11e9659cbf
SHA512	16ef4822010f6e3a7be2ea98d7a3815881aa725ebb84d4b31e4a067751b3dccaeef55fe999ecaa851a8716161f225ef90583fa8ac852d5c2f733aee012e42278

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\msvcp120.dll

MD5	63f186293c962d175275067ffd8ddca3
SHA1	8c387813cf2ccf516d71c6b07200ceae8c7562ed
SHA256	8d1073426d7985df7c36e8a4f14a37db11751f91734e1ea02c1353b5338e2076
SHA512	330d20b1c8271abf6b0eff37ef4931c8766d7fd2510f1894187ef70698de63fc321689bf2e5bafaf50535f967d1d1fb2656679ed803b325f4a09cc194f441392

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\mlib_image.dll

MD5	80cdb4c2e60c17309ff092537c9b3328
SHA1	2543070758fdf74ef20a962914e32f75be1f4636
SHA256	b39454a6eaba62bfd1062485845eee1bf650ca83be6d1a224b655b25fbc043b3
SHA512	5a7b0800f90ada473a813d8faad34da42baf0f3339f88958f19a4c29fd65aaab7fcff1abcbac12474266b29b6dd754840ead1744f080c01a5fec61bf8d01a3d1

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\npt.dll

MD5	dc597390a8f4d1be9614b4e6b5011b51
SHA1	8aa208d215e6a241f9cb6dd4cc581375a14d6e49
SHA256	7e44c5a6502dc9ffc2a873a02f787bed68d8b3b78ebb1180963862784f0d7ed0
SHA512	0e59ca645f114e71bce0dcb5a42902ecc1196cc2e1a7c6f67b1be9427abf35491444582af6a5c1ac5f87e0c41426475518c477f60311a7b92f74858b6b13d8b3

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\i4j8572725557414237971.tmp

MD5	2252175f04c153fe9fefaabcbfced959
SHA1	dc53e697e8784a23e6e1912101a483ec9430e505
SHA256	487448c2b8eb1ada34790cbd23074886d8ed27a138bd8c01b29e5f58ee4a3833
SHA512	e78977af0943a80d37b13b88405e0dc1026b65fc5c263c12f92d1b4fbd0ffcfc9c7c3b4ae3bb6593535a96693086a29b9f69cdda465ec53980ba85e7c6968efd

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\i4j8498364627077624819.tmp

MD5	0f96a0a7d4e35e1748f1d61f4c8c7572
SHA1	dbddfb62ea707f237891d1c1ded0c8f0a9e23678
SHA256	62d8125718a18af6ec5de7bdf18a2dbdaf7d6b85098c50e321915744c4eb84d5
SHA512	3b2c7741a59ebe8117987b1637471659a7c887cbe4bdbef4b288eb976115a6b210198f70dfdd402987115403083a65cb7afe41a7e0783011534c355932d00922

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\msvcr120.dll

MD5	d4fca957f344859d45ad0274860180b4
SHA1	0bb8a7a895ab8875bb03048a4541029ee665a4f2
SHA256	c084c86d1642a7775a36e85223cd80549bbee887d6e8b133f5953c37e7ce0e0a
SHA512	934c799f8f155aa381a6c7d3208dc5086fa7bd44a114ad7f0bfe3906e555cd766122f43418d8978cb52538e0ab14fce9e6154064dcaa121e205527a3b718acfa

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\pack200.exe

MD5	ee4257f5f8ee02e20255d18943a437db
SHA1	70eac4339329837056e3ccc50947065e5b7b0855
SHA256	04299749d654364e7a7af3b0473c19fcdeea8831ad09f80ed86b2494dcf16613
SHA512	e0836bbdbc789ea7a6b8b9ffc967c39c29943ab36b2d5c899416541df363c7cc9212a631b1c22e5d876555d5296e41c0a23f4e9ac26de86f3219fea3059c47bb

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\orbd.exe

MD5	2b4c67c888ff52efc633d3ff09bce581
SHA1	8e2c26fbd544fcf032dd255b9a76345fed9341ae
SHA256	93f8ec72e73a811bd1cb676631d72cfdc3908bab3e9eec55fad50136ff05bf95
SHA512	54384126ed236b2bcf55438f1f4c019149a8c895c7e3b14a0dd0f4f8b8dfc44fcece956809ab70c42eb57dbbdd1d7002e4686f27cabcdb0bd7ad3d699e456e08

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\policytool.exe

MD5	f8abf0bb2b7b26cb0db51920cfa9a733
SHA1	7e919eb02a97d6556a569458234b5e35fb1bbfa0
SHA256	901f3e911109a5410239e9054fcdc017841f6c5050ed3942fbb2dedaef85c263
SHA512	d4a5ae8cc7f581ebc38f82d605322f20bf7a64ee2121fcda50d1442412c548c0a4aeb4158e54bbef70fb7e76322f58bd2409cca2312b6a9661aa7aa31a3a6e34

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\sawindbg.dll

MD5	9d7a5584a5d2cb5249b04bb6e1e5f674
SHA1	cee47ffb343975d4a1b5d5149afa1b9d9a270b94
SHA256	79f41e83cda217eb222643bee7ec4dd2fb3b7f59dcba8ffd0a118a9d0b40e41c
SHA512	b133f0ecaa6c378869b44bab0be196f3bf4690ce8a052d2de22d000bb58f9a5916bab5411554d605d7e16f95eefc742d399257b2d9107c14850a71fadb2a0400

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\rmiregistry.exe

MD5	75826ea81dab6bea3d8a0a37da8ea270
SHA1	ce7309b1a2b1d2e8b9c7d447d9dde5972189df30
SHA256	419098922f52c26ab83939684096bf4e8b8338d269bef793c18d4e06ec04bfe2
SHA512	08c035a07bdaa047aa256a2fa81fe2328da9a0088906a2dc825a6233d9109749d400cd956e6e1e29c39bf109e6ca78f8cb46392f92e8f9f9befba82a8e5f899b

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\rmid.exe

MD5	b18177542a5f0943037c14fb3fbce8d4
SHA1	0ad7fad411ee95637b24be44eb6ade3989d1b943
SHA256	521ed67d3224c1fe6e3639cc6632ddc7a8d7ca3507e34c59cd10c1b0bb0dba84
SHA512	88992121433c80c1bd862303ee5c795e25842ced5566209afd5f45b0665fd2a1125ed066b47e2ea1744e3d4d5f408dcf2a5408ee380b7efe2c959c659b8b5340

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\server\jvm.dll

MD5	7ade22cf42b8d7982de304f289f13acc
SHA1	4ec695fd3463e5004698603636cb9d26c1ec8d19
SHA256	52c068e313659dc05644d75f10ccbb603cdfec2b139834cc6681c441ac31a165
SHA512	894dc618be52d089864d391838f2590a957f9a9c2c7f3da4431e3fd26c1e6d32ec938b955b7823a0ae3c31b37ef5e0aef2668325e4b232171a827d8535331daf

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\servertool.exe

MD5	ee5c77921353e76207a33f8ef5d423a4
SHA1	d3eb628e90ddfc79beaa628bfb832a4b8553b045
SHA256	c5d97585a25e21b90c15603495de3e3ffc3379e130b54f4d4c0e024f9bd48635
SHA512	622db92807b783174511bdb590d55d709ba1f0373bf4a0fab3584a43ec8851a578870dc7203393cdfbcc47ed6e02f0d854191cac19536c011f3ab4f880b90a75

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\splashscreen.dll

MD5	bb7b392f4b190906223fc74550836c77
SHA1	966cb986ccf9944f5c9126282bbb8ace0f9d35f2
SHA256	a726d4c82fe695ddcc065b6453936efcedf78f05d41d1c2b7cb5831477545eb1
SHA512	9ce0799e5e74f545ae2189cf43053671889ec213278b4dd5a39f156976fa1080c6e7019faa6cd865d52213c091c5a7e9577953658fe4faf40aca5d8dede4ec98

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\unpack.dll

MD5	e0162355a95e1449e16d69aa17fc6b23
SHA1	4a1cb3d6941259d49b9bf15e802afe3e29411caf
SHA256	82bb4ea694ac9cd2fc3e647a7a38b8da2c3485f14c73502511d6337a77e34ce2
SHA512	0aab107cc3fdec813a3f00ca10f866b00face72637ef011ba1246fb549b6e38feb5849e6cf2424e8f9c851ff9c9e33e3cd796fbfdf245fefa6c04a16bfdcc891

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\tnameserv.exe

MD5	33ebe44ee72ade0936c00f2f6b114b95
SHA1	7e7bb92b27a846117851f86b87515de74673c255
SHA256	94e6e8f7ec4d7e931d23f61086571300d71fe0a5e91dfbef02b1d3efff43cbbf
SHA512	fb35860dfafa6721c9ddba39656bfa338e905f727afdc0a8d176e5f2e488537c05e625902afcdc1efe254a56f1d94a7b3a61e4bf2603533b59675f4ef692171a

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\sunmscapi.dll

MD5	751d01b8e06c5c081fefd25d68fb2f98
SHA1	6a73b9edc27330465bc0ffad08a431061a337e06
SHA256	ea1fa30fc59b1afa493672434a0b6b18ceff62a86a1e2b929f91d1a8a8def55f
SHA512	986a0069957ea9ea4266ab6948c4ead1047a5d9881dd50ea9d085603802919614e3cae6e91ea48a2d81ee416b3728ac4deea11e6ca87f9cff2008a86993bb9bd

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\i4j8894524780960764239.tmp

MD5	b55e28afdd840498a72a684808e7815f
SHA1	40c017620cf6fb132eefc68a45d270c6a967d177
SHA256	275c5f1906f5f014ea89c341309a86f3518bd02604ae10ac5c1a1ce16d54b6f4
SHA512	1b983b2b24f799f8c4f4e5128da3fe5bd3b68fad0ae6c81a6e61caaad2e1d60420aacd5da8aec1c3592e739f17f2dd3b52243ac3c20e2a1e0e83b7a29a0bec5a

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\verify.dll

MD5	738c1e31ea0ebf505a2551c895f88834
SHA1	0006d1756a8693183a2e598a4ed9ef7b30af40f8
SHA256	feb2776ef216616a0a4847eeed34e7a46865dbb90c45f22e8d05bacb33a9f90d
SHA512	61434f6965666956c430e1b9460e939234de6d73a6aea265c1dda8f64f19fc87a7a4c23149636af9a3a17d1620d861c5614664c4e899bfbb4ad6e4a47d6451d7

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\WindowsAccessBridge-32.dll

MD5	cfc87bb88a7310ef93bd067531062841
SHA1	5f21126ea4fcca78bc7a714360f3d2e687b7375a
SHA256	1989802fcb432e29e2d4236e4fcaf2c81f1e32f37f801cb4a1c677df4f55fd05
SHA512	54a1d29e299bc55a7679a1ab5880998e29efddc00eb20c0b7794f5f5bfbd5693f50ead2b54389cdd866ae94dc5f8cd7a23f0e3fa1e5dd1b14dcb0911669c73c9

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\zip.dll

MD5	4ba1ebae9a456c69e6b8f5254e14ede8
SHA1	e1803c84affd2ada775346b17307ed96613ce690
SHA256	cab71b4437364557a476a4e8ad53103ceac3d50204648836221611eecb67a0b4
SHA512	9b667cc64359bbb92844cd277431be53e886812964bca0d59250c1210b95c6c2856730071b406649bfcc9f310d7f1862ce68940bd72f15646c4a10405bd70d93

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\WindowsAccessBridge.dll

MD5	2e5bdf843d343ec88d28306a60be81b9
SHA1	442737f5a2acb5d0f188021337873e3ed16f7c9e
SHA256	092b6754a12733dbf899ebe5a5e77087e81252ce9e640d68cedabb5fb889c237
SHA512	8d5a44b0e75dd77e67f436b44b95b1e4fdc37ec840822622b97322c9f0f729d8d0d06ebb608b2c67c6ed8df1edd85e90b7cba90f0da34e795b2c4427275c7c10

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\bin\w2k_lsa_auth.dll

MD5	018c7e2d693f6e77df35a8e8fd332a6a
SHA1	48e46237749bae0b76f617e8ae1ccfda3af1ab8f
SHA256	e05ba5558c48f7f8f85b873b8e488494cc44605a0d2dd14890e1730c8c5467eb
SHA512	f5ea0bade0a5f0de2b9133aed134bfd80e46ce2f9037dfbedd5adebc1939dbf5f2aec603ef1be0efa7fbf2adeb077aa03accd0ce16ebfb2d4cf1e859ec41e409

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\calendars.properties

MD5	fd47532d0c6ae3bec63f2f1ce3336a6b
SHA1	e969a98067073c789b02168b211277eb393db634
SHA256	9b72cfad9723c8b33eed3e18bda69be3f50740f8c11456487d3098e288359bfa
SHA512	ab5975ca676f7f08eac58902c352ed9bc67e03b75d6c0155ae75a1a4cc478905fa153f8dd7c1bce0162c3c17e738b550f43d6341b437502f71b54152b307f6e5

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i4j1375432832492131924.tmp

MD5	2ed483df31645d3d00c625c00c1e5a14
SHA1	27c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA256	68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
SHA512	4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\cmm\LINEAR_RGB.pf

MD5	cfecf0a79f8e6dc8d8120302f2a2e837
SHA1	7576e83e5911096471a97f5e73f3238c6ffe6976
SHA256	790da58ccc79d03658283652716ec9896ed31e0392d818e60f6832815ee79f4c
SHA512	b5a90b49ad4df94bb7e4d88796baa7d6f908d892815bc3b59e441b3a9262682eaa5610052d75f76b87b85a577d2e12096676d6c56152b0e80dae6d7b72ea31a1

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\cmm\PYCC.pf

MD5	2f3658826c5402382e78bfda48a78a6b
SHA1	da0db2d41e6cead9e38a7e4a5c08fa7e90e57b22
SHA256	0031aa2b8b4d490369a2a601ae0d95505df0cb86c0504f080c02ed87e84b3ddc
SHA512	f1114143e1f656dfd68e3f32d87439dfc1dddb859e2664da3e902feebe3ac63e04213230c9ff3ec630e390eb3a85e2fd483a6e5ad2992bf3d89d1129faf86bf5

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i4j7813943285850287105.tmp

MD5	eca8c4708672c29c2d10342225022f8f
SHA1	f09a8c2799109dcbf797e977d45ef31d83842b8d
SHA256	09fcc77f1584e4222553f7ae6b6d4e6735d7950fa0dd1a7fdc8b91aba0f53915
SHA512	859eb295b4922eacdc73e11c2f09ba44cd4c0557f282bf3344d90f57ed7151e36bcc343d42dcaca4d24a8814af1c27216e13df8f4a2d79a8f57557ba5a0266d0

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\content-types.properties

MD5	f507712b379fdc5a8d539811faf51d02
SHA1	82bb25303cf6835ac4b076575f27e8486dab9511
SHA256	46f47b3883c7244a819ae1161113fe9d2375f881b75c9b3012d7a6b3497e030a
SHA512	cb3c99883336d04c42cea9c2401e81140ecbb7fc5b8ef3301b13268a45c1ac93fd62176ab8270b91528ac8e938c7c90cc9663d8598e224794354546139965dfe

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\access-bridge-32.jar

MD5	57e058cf78360a3c9094d112357563c1
SHA1	b2e0be93af36bd5820590ea8fe3d41b44b158d70
SHA256	d70cf912e5e2dc296f01de7b684560f5dd8b4e87f4d37930d90fffc9fa8d64f8
SHA512	476a3f4a329b847af5da3f312989b3d945242af1041879213c6204caefe303994e6f3be62843f45b25a79701e8abde2e8dc9333e6ff30c484706d70c53dcaf0d

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\cmm\sRGB.pf

MD5	f6439592ef7ced5abdd4ab4cba3777fb
SHA1	11c7be03d659c369474a6f2231561350ae7889ab
SHA256	87e382b9336e6a0417a4d860173109ab319a029cf2972e19833a3327c65bd7e4
SHA512	9029be4a78e1a3c59fb2587d9a8e9edfb08415c9d4ec4c5956808c0144dcde6fd78f50a5d6e7a3ad441be332c9207bc93b83a4b96ed6afdff257d5cc7deade10

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\cmm\CIEXYZ.pf

MD5	09bfdcd5b55fe322faf0a4cf94f289c2
SHA1	fb7d37db9ad5679600a27352aa1998d5bcdc9311
SHA256	98cf012f6122c833b1ff4fbbe37f43a808d769d9b10ba43f3411728e7bb58bea
SHA512	f62d3f6762f6649f97b0df031c2c381bb4553c7b5cdb39c8ed87e8256ec560437b7d60e728fd10a581efb5f4ddd3d213c9b25707830e32845b451cd9dc3540f5

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\classlist

MD5	7fc71a62d85ccf12996680a4080aa44e
SHA1	199dccaa94e9129a3649a09f8667b552803e1d0e
SHA256	01fe24232d0dbefe339f88c44a3fd3d99ff0e17ae03926ccf90b835332f5f89c
SHA512	b0b9b486223cf79ccf9346aaf5c1ca0f9588247a00c826aa9f3d366b7e2ef905af4d179787dcb02b32870500fd63899538cf6fafcdd9b573799b255f658ceb1d

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\charsets.jar

MD5	fc4279367a726d5aa9c669cf6333c47f
SHA1	e2a21b53f3e0f5b05df009dbc48e57e6596dabff
SHA256	5569c0ec33d01085b1185cea54f3ae89a1a8ea14f8c1c14eeb4cebd694e91ddf
SHA512	38d1ba024f913354037ed218ace119e1e218ee76c3f35d3d54904d2d350fa42ae4fa2a06da419af1ed3d64c7485f04b79867b560d42f747a54df45eab387aafd

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\cmm\GRAY.pf

MD5	fd6340c81f2adc503aea746b79a96979
SHA1	d73abfdf682fd0f570775b90e40d714976339f33
SHA256	d3fd8cb41b7ef8c5ea53bfecb1ad6d4762197c8eab04444545e083dff6f86fa9
SHA512	a2c861b66c78c66119172a57ad96bc68cc51959b4a41d300c30fe16e4d10077a8f6b0328acda14602c054bd291da49865c77b8358a285211df7e10011dd06934

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\cldrdata.jar

MD5	14f2ca623cb7b09f268c2b1f0d225a6d
SHA1	4ab523df8dd2950a04fde940e8a2c93694f34c6a
SHA256	98de882a4634631e4a87e359f80d7eb5173af6282bd42756c6facdf2ea0dcc5e
SHA512	1d163e6ff79ff2004591cba41edbbbbcfa106d7b7b7e2589bd67dfb95206c1d484e9baf8652a75bc8dc0873425e60696ca191596f74e0539079161c72b1c34c7

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\jaccess.jar

MD5	168c8c541adc71c0cd0f804b220439d9
SHA1	8fb7c9eed5ec78095cc0da8968d07075e3aca150
SHA256	5d4a7975e64137bf38e64a32752654ec811b0c942fd8c944497d80d0410aee28
SHA512	dc862701d858a87ae39d2c028a7b3a8eda130d7086f695bdbf83ff25180b9f428931f0e1943a70cec7f2d2744e720d6f4b60ad75bcc55d05855e52f3c6388e44

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\dnsns.jar

MD5	e18d3b52a78d35b97cc87d31290018dc
SHA1	b2e6f66ce5e1766e9e80a963602d35c1dd6ca858
SHA256	d46436ebf76018bdb6089de616c6594981eb8dd489b4711d5e2e9bf87de2cc1b
SHA512	0254f38f7e2199e7ba19c44a7d8c722f48815686eb9dde5f8a8e6c051610f524e320914823cfc13901410ad2381808129317c59d3f5f952167233a55395f37d6

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\localedata.jar

MD5	b35759981e790b9759a58c94c2b404eb
SHA1	ed06f8135db38716e286bb07ff83cbc619e1f09e
SHA256	ab9c3aa332bf6b08794b5a70a834beee34295a8b46664cafbe4eccf45d152c6e
SHA512	279832c7c58d5337ec3e1a57212d9e2a3447569f49d5fdf437185b9459cc633e3dbc7d0f06e8f477e0f78d409a18be402d5d71a231a832bc87eb7842a4c031d4

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\meta-index

MD5	600442acb9489a49c80336513212b298
SHA1	8865e006dc66bf1ef53d5e35dce998662924019f
SHA256	1f9f60702cba1af1bc7ca3ebabf8c474c7bb68972c6f32ed8ee26b1370719eb8
SHA512	e9649f3f10b7e2644c12bf5adffb612d6cd081264a8fb362ebe53ac4a34cdd1603f456cf63bf88a594b7e523af8d8081b4cd9c07c3565ebc7551ad8775bd65c9

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\nashorn.jar

MD5	d41c9901a07d4c046f19170fa7776add
SHA1	69bbaf7d374517854e6d5ebe309ca22e38186a3e
SHA256	baf0fd2cc0489829902294da099b55f9fb12667cb937db5d5869b56c29e0271e
SHA512	78ff619248d8aa76305939b5c3ef3ad4079cb4e1ab46bbf324847c97fe6e1c3738202405e42a45865054bde3a9d320884be29a85e04b05c69fddfd622cbca5cb

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\sunec.jar

MD5	5dcee52cfcdc60669576cdeedcad439e
SHA1	daf1ff332d005390780f2fd694f4900284d2e5b9
SHA256	5eb068fcc205a6f3eb0541233394a1ceae2aab5d583faf48241de40c6dd95e8b
SHA512	71fd308b14f8bb8e7ffeed72735e022a38b84151b2f41732d840a125476161dbba0ed93353c1a7a5e0256f305b55e137ff14e4e1330c1f59f161ed4b0b87bb0e

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\sunjce_provider.jar

MD5	eb211f2538a94ed1b5a4b4e72e009e04
SHA1	65ef7068f83767da7a1f93b8bc46e8910ee9d5ee
SHA256	f9b573ff16c5cfe8a53be114fa697d0c3ad74ce83ceba0e2c98bb194e814ad2b
SHA512	87d9e655740ff11bb883564392daf41c32313c656fcafa440fc611d390c5ebc942a8099acc6d53b92aa5b6ad8dacd7cb1fc017d5c3e6b0e99b86bfee4ad512c9

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\sunmscapi.jar

MD5	feb0a57e78b8143cf55855a22cb93f04
SHA1	a892b2d242b20c05847703438c5284c6856498a1
SHA256	4cc37a6dd53441697e9fd6f50080bc9b068e4fe8d2fb7ad73f79f38681c7d070
SHA512	0273a3f631738d13f157b261bbc758143d45fd01b58737c6a8eed99d09601fcdd8b5a8e6d6363d3fec25eb0e6a9632b5c2af33b7ac77ba904ba2942e1742ce5b

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\sunpkcs11.jar

MD5	8cd5a419142bf938156f279bc9f41a3b
SHA1	d4779e0bbca8285fa000b1ddf3b30bee8faa167d
SHA256	96278bf04b88d47c2e20fc8bed9eec22e8e779c807b1246d899d4b17daf97c41
SHA512	e0c60837fcd45cfb47212c44c8ea64f4030c54380deb93e6c033a2d7bda17cdf803c4e304a0524a9390b56f3f29425e2762863b431a8cac7697b5b24f604395d

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\flavormap.properties

MD5	d8b47b11e300ef3e8be3e6e50ac6910b
SHA1	2d5ed3b53072b184d67b1a4e26aec2df908ddc55
SHA256	c2748e07b59398cc40cacccd47fc98a70c562f84067e9272383b45a8df72a692
SHA512	8c5f3e1619e8a92b9d9cf5932392b1cb9f77625316b9eef447e4dce54836d90951d9ee70ffd765482414dd51b816649f846e40fd07b4fbdd5080c056adbbae6f

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i4j2706029957508480141.tmp

MD5	ad8365719b70a2deade79683d8986a15
SHA1	88cbf37d05f28691b7f82e74fa891792e93b41b9
SHA256	b2ab990df3c4c1c2ec4317aaf22c946df17f0796727dbda712402307c56558ac
SHA512	287b19b6996a189baa3cf2894a57917b14b0615d551c5248ad55860678e5d6e58dd21247799bebe91b8236fc2f5300399fcfc1bb159edb9ae8d663805c6a30f1

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\hijrah-config-umalqura.properties

MD5	7b451352f9f9eac657d963c5d2921dda
SHA1	d8c664ac3e18a044465b4f76311661a4f7f045a2
SHA256	3456982de9eba535337852f02852e26e4ed197ebd9d8356977e6da4ed9075538
SHA512	822be7d4e40408dcb0788efc521fb13eaf3650db4f934cfbd37d00c0026d35d254cf415d5ad7273c78fced84a582bccf101e413c0686095cdde4bfa93f883e13

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\lib\images\cursors\invalid32x32.gif

MD5	1e9d8f133a442da6b0c74d49bc84a341
SHA1	259edc45b4569427e8319895a444f4295d54348f
SHA256	1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA512	63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\images\cursors\win32_MoveDrop32x32.gif

MD5	cc8dd9ab7ddf6efa2f3b8bcfa31115c0
SHA1	1333f489ac0506d7dc98656a515feeb6e87e27f9
SHA256	12cfce05229dba939ce13375d65ca7d303ce87851ae15539c02f11d1dc824338
SHA512	9857b329acd0db45ea8c16e945b4cfa6df9445a1ef457e4b8b40740720e8c658301fc3ab8bdd242b7697a65ae1436fd444f1968bd29da6a89725cdde1de387b8

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\jfr\default.jfc

MD5	4a17a34ea96b3dee68cc173ff1317948
SHA1	fd81084a9b8407b60b457b9aa95c8bff31e78bb7
SHA256	07905e9fc1be1a17fb74df479bedcf40fdeb0427722b0e2d12af96a4705a5e6a
SHA512	7d73113c38b49c024902972135b2243a2d2223e4a3cb3db51aa84a79495ff953fcb41e7556f26e9b8f131c6565011c95d92769613265998f2586691ce15c17f0

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\jfr.jar

MD5	c47cb4bbe54e7bd82e138342e43a2b71
SHA1	20b36a416e1973ab46e3d0e43e5db338706bb5c4
SHA256	33fef9283272783bb3bb0d5a77413d0d2672a48e6347911070cd8fcb08aba2a2
SHA512	9ac4eba9741d816b08d298a4042107047e9c5e3f3c4fa088184365c9c3ff59372976c60820a0afd1c8a250480d34ced24089fe08af83de54f9419730e1e5fefd

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\jfr\profile.jfc

MD5	35922901e0d5d7d88e6ee01dc7fe3ce0
SHA1	1ece05fbfe6da2cd68a09eb04f4bb1fb930378c0
SHA256	0207c7ddbba287366723ecc65641b0e1f03195895d4a39f36d8e1d135df13e84
SHA512	f64ff26c637bf984cb50342408ce7e4a6e93a5996c77754018e5104da521f142109a48f6b295db7bbaf58bbd07bd0fb7b5827a769303528fbc6ec30e57e50567

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\jce.jar

MD5	105d024567a76537a96f92af4b4524ca
SHA1	80805e9d93aab05ee28d5cb36f1229669e670b29
SHA256	2807e5f8bac98c3c181f5b885636d7bb452ff04c165ee29bd38c1fc48e1bee70
SHA512	9a89b67ac59739f20d664c5e98f43eb847d7dde28c47ba7ae9327a7587f08c20a022db23188b52e9b0ba580b57f7fd59166a0cdebe5273aa2795265e58d2c647

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\jvm.hprof.txt

MD5	c677ff69e70dc36a67c72a3d7ef84d28
SHA1	fbd61d52534cdd0c15df332114d469c65d001e33
SHA256	b055bf25b07e5ac70e99b897fb8152f288769065b5b84387362bb9cc2e6c9d38
SHA512	32d82daedbca1988282a3bf67012970d0ee29b16a7e52c1242234d88e0f3ed8af9fc9d6699924d19d066fd89a2100e4e8898aac67675d4cd9831b19b975ed568

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i4j2083746163453821599.tmp

MD5	809c50033f825eff7fc70419aaf30317
SHA1	89da8094484891f9ec1fa40c6c8b61f94c5869d0
SHA256	ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232
SHA512	c5aa71ad9e1d17472644eb43146edf87caa7bccf0a39e102e31e6c081cd017e01b39645f55ee87f4ea3556376f7cad3953ce3f3301b4b3af265b7b4357b67a5c

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\jsse.jar

MD5	157386cd383e328dbf706f89552a2557
SHA1	3a158a20bad2ce6d2faf495562f8229b2c2de855
SHA256	56c34132d6aad434dfc7bf70dccda5d17d03b5fbeb69b38fa2dce76165a399a8
SHA512	f22b20bb14c41dd2783854e957f6970b4dc3e90baac336b74062a49111038a614a2b2171c963730addf98296332487938b1db38b48353dfbbc5ab4aa3424ca0e

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\management\jmxremote.password.template

MD5	7b46c291e7073c31d3ce0adae2f7554f
SHA1	c1e0f01408bf20fbbb8b4810520c725f70050db5
SHA256	3d83e336c9a24d09a16063ea1355885e07f7a176a37543463596b5db8d82f8fa
SHA512	d91eebc8f30edce1a7e16085eb1b18cfddf0566efab174bbca53de453ee36dfecb747d401e787a4d15cc9798e090e19a8a0cf3fc8246116ce507d6b464068cdb

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\management\snmp.acl.template

MD5	71a7de7dbe2977f6ece75c904d430b62
SHA1	2e9f9ac287274532eb1f0d1afcefd7f3e97cc794
SHA256	f1dc97da5a5d220ed5d5b71110ce8200b16cac50622b33790bb03e329c751ced
SHA512	3a46e2a4e8a78b190260afe4eeb54e7d631db50e6776f625861759c0e0bc9f113e8cd8d734a52327c28608715f6eb999a3684abd83ee2970274ce04e56ca1527

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\meta-index

MD5	515d7a1fed569af7a4e65580d993b16c
SHA1	7aef4c3dc21f89132d15c5cca021b36717944f39
SHA256	daa262732f1f698294822c762d8e33db636ad67f21b402eac70f78f315403fbf
SHA512	16ffee33df2916d07cc08b9166fd898ae7c005208f680f97ee94ece1c97c78b33d56021cdaee6f73f07155a9ed807c30ec1025fceec7e771fd199d96c44362ec

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\psfont.properties.ja

MD5	d4c735bf5756759a1c3bc8de408629fc
SHA1	67c15e05a398b4ce6409d530a058f7e1b2208c20
SHA256	5a4bd51b969bf187ff86d94f4a71fdfbfa602762975fa3c73d264b4575f7c78f
SHA512	8124b25decfa64a65433ff2ce1f0f7bdf304abe2997568abc35264a705f07152aa993b543da37c4132b4b1b606743c825c90a0eb17b268518d478f5cf0889062

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\psfontj2d.properties

MD5	17b15d370018acc01550175882c7da91
SHA1	4edd9e0fc3d30fbdcabcdcaab3bc0b3157fc881e
SHA256	780c565d5af3ee6f68b887b75c041cdf46a0592f67012f12eeb691283e92630a
SHA512	e4ee92d4598385cb2f6f3a4db91ddabd7e615dc105ed26cdc5b5598d01c526cea7726ff93f92a308350229f2e5a5dd64cc0c38865dd97666368a330b410d4892

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\net.properties

MD5	8bc6628d01bad30798440cc00f638165
SHA1	fd9471742eb759f4478bb1de9a0dc0527265b6ea
SHA256	31ce7ce29c66a1696a985a197195b5e051b2c243ea83e9d1de614f0c4b4f7530
SHA512	8da3439774a07a6309f985d1a29dda5383975bbdf6b8e2809bab69a2c44f65d3de2a546231ed6e183864193f834c9a7042fdcc4ee10181d0bd3891363032c242

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\management-agent.jar

MD5	c891a28e86a734d43378974cd035843c
SHA1	824fc111fee9286005320c33d3028e65bbeb9b09
SHA256	0543b7b4c330993b586f8192609535c91581414ab78f630e27747d403126a211
SHA512	8dba6578d75233753c6f98eb17c3fc04799f47313eca0313282d97fe09fb60815cdcfa45b06d0d728cda38fe71ec5d8ea7974c33552dac28ca04918183838e53

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\resources.jar

MD5	42d1cef8bb1383ad82196c90b919b038
SHA1	b99514a88b91a0a5d342a92dd1935cfe27581bb9
SHA256	795e647e44c9f4dfaa36d3fd7093c69242b377c0dc77c9eb7ca5b1b97955e8d6
SHA512	1246aa31496c453885be5ec8a9e92c4329a7a320f409ca13b8f066dd1d91ff2bd59199350f35c030801d6d47526115c83c15e2b4e37c30a126f7e9ffb105d2e7

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\management\management.properties

MD5	5edb0d3275263013f0981ff0df96f87e
SHA1	e0451d8d7d9e84d7b1c39ec7d00993307a5cbbf1
SHA256	3a923735d9c2062064cd8fd30ff8cca84d0bc0ab5a8fab80fdad3155c0e3a380
SHA512	f31a3802665f9bb1a00a0f838b94ae4d9f1b9d6284faf626ebe4f96819e24494771a1b8bfe655fd2da202c5463d47bae3b2391764e6f4c5867c0337aa21c87c1

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\management\jmxremote.access

MD5	f63bea1f4a31317f6f061d83215594df
SHA1	21200eaad898ba4a2a8834a032efb6616fabb930
SHA256	439158eb513525feda19e0e4153ccf36a08fe6a39c0c6ceeb9fcee86899dd33c
SHA512	de49913b8fa2593dc71ff8dac85214a86de891bedee0e4c5a70fcdd34e605f8c5c8483e2f1bdb06e1001f7a8cf3c86cad9fa575de1a4dc466e0c8ff5891a2773

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\images\cursors\win32_LinkDrop32x32.gif

MD5	694a59efde0648f49fa448a46c4d8948
SHA1	4b3843cbd4f112a90d112a37957684c843d68e83
SHA256	485cbe5c5144cfcd13cc6d701cdab96e4a6f8660cbc70a0a58f1b7916be64198
SHA512	cf2dfd500af64b63cc080151bc5b9de59edb99f0e31676056cf1afbc9d6e2e5af18dc40e393e043bbbbcb26f42d425af71cce6d283e838e67e61d826ed6ecd27

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\images\cursors\win32_CopyDrop32x32.gif

MD5	89cdf623e11aaf0407328fd3ada32c07
SHA1	ae813939f9a52e7b59927f531ce8757636ff8082
SHA256	13c783acd580df27207dabccb10b3f0c14674560a23943ac7233df7f72d4e49d
SHA512	2a35311d7db5466697d7284de75babee9bd0f0e2b20543332fcb6813f06debf2457a9c0cf569449c37f371bfeb0d81fb0d219e82b9a77acc6bafa07499eac2f7

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\images\cursors\cursors.properties

MD5	269d03935907969c3f11d43fef252ef1
SHA1	713acb9eff5f0b14a109e6c2771f62eac9b57d7c
SHA256	7b8b63f78e2f732bd58bf8f16144c4802c513a52970c18dc0bdb789dd04078e4
SHA512	94d8ee79847cd07681645d379feef6a4005f1836ac00453fb685422d58113f641e60053f611802b0ff8f595b2186b824675a91bf3e68d336ef5bd72fafb2dcc5

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i386\jvm.cfg

MD5	b8076cf8e6635a1387956ab123797171
SHA1	d23060fe12f5ff5cc22948cbfa1d725f8e2323b8
SHA256	5598fbb38e2fd8681bd6630eb355d846d14b0acaff292742d3abe99916a929e9
SHA512	9723af759ed0e4fc2055a9f29fc4d0f4a421c6ae8f10c9efc1d48078e6fc14e6c1177fe7a8cfda49ef771f8bcdeb3f9e8c3afb0adb052aaabc43a5c889798de9

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\fontconfig.properties.src

MD5	d4d5981664d4cb0ebcb6f3bf63505b29
SHA1	4720b7407706f4e0d80cb458194e74f8fc3b83f1
SHA256	f13df9360e93b24820b24652473f6cb0f4f70fc346aa3b408acb94ed59cac0ac
SHA512	3658ff76c882511e7ee3821bbd31c3ce0d3ff263ce5f69659f54732667cbb9148adfbd0bbaea916071e1d38db671bf6ddac84ddd3362cff0ddf21c7cc1240df2

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\ext\zipfs.jar

MD5	871deb6e082f7ea5e2c902632f26ba1e
SHA1	140e3277acb738aa35c7ca92d83ba6e0bd2f93e2
SHA256	15b249367a95c3493331f48bae679e6c50caadb876862b6f500babd82e7f9d07
SHA512	97d74b9fb97419ece4605607ceba12e9d862ce0b79d71327751fc721c0ade7bcdb9594667c91d1bcb7c7488772f7279a509c27f3b7fcb2b462fd9f1c24f21070

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\rt.jar

MD5	3f393b6a3441d8cd7f76f797fa0f861a
SHA1	ec2b54f6dcf0d6bffc4db84af3eeb7cb3a37c605
SHA256	72d9064a58fb562276f616cd0160a9ab247f73cc40ecdbc4d3b090f3e3f5cb75
SHA512	406dbe46ffb017a666e744b2d4cdccc79d4fb22c812cd4ed62f62b1f876c6be87ec688501b41907af922ed26ff02fd9bdacd6df175ea9333fc85dfd4d1731492

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\security\cacerts

MD5	ab5a7513aab4813cd362e6ed59188394
SHA1	c63ca611445831fc2e1c9a789f0a2bd8cd5893d7
SHA256	2807331239c58aa341897a5c73f25db993e3ff80d6e50ad1ae9e98224a53e843
SHA512	e1f4ad7c71bac7940e9141bad690ff4b123ac99ad2046fa69263aba00fb581d23d0ac05db459f17c01372cd9d0bc794825d1b858cec5739c36040a3864219d52

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\security\java.policy

MD5	fb70580fc6a4b1da1107e311ecd24550
SHA1	0f5615748a51cda1d38882866d6d330b52681507
SHA256	c22944481deab4fd7c2b7668fc9aaedf28b2424edd71c1fbd13100fc2a5621e6
SHA512	4ba81b7f3a70846244ce486514adacc6becfbc702aa6e7ebf1291987ec0dcebc6a99b126d7aa3809b65472cb4c86562c612ae1a71cb888db75f1934c9e2d4c64

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\security\blacklisted.certs

MD5	19e78890d61c0dfc65b291341c08beba
SHA1	ee0288462fc32992a0f9dfab5aeb3385412f0c4f
SHA256	96572f243f31c2ef81a6e627542e596f6a9295cff3c7ae095c1b595cb1457ded
SHA512	c6d8d4ee0eb7eeb14532512ff4310dff9dd4f31d112716fc67a1052d37eef18d4bd6eb58301c76167ad35d31e73f5b28993f4da8c5de2dbe3836a5ef7e9c8b7e

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\security\i4j8408671549724409229.tmp

MD5	3792edb7754dd3c432a20b77c4d9f0e4
SHA1	b685429484c738b0a7996df5169cc3d0c651696e
SHA256	7929784fbc1f8cbb1545edffea428ca34f211713e5c045b43c60705d458ff68a
SHA512	02decc64054212fb62af06780585247dff7dc0954e672b35cf80fccbdcc32f94ad711d4c560a9e90c41c06d51c4f7a7e476be52b6b4275908458ba51f82c62c5

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\security\policy\limited\local_policy.jar

MD5	1af24bbc2b5ee82ef3eac716c1cabe14
SHA1	d3986b45a987940eb9b3be2ea4514e29fa87c618
SHA256	98fd606a234ea3f7a86fff6b4615e3b6a1a12b828636d32acae7066ad7fd9ea5
SHA512	01c0b193b2003f2f062f20040ce1f370812dd5da27de1db38953adeec312c1090c96b7e784cfa1245324af6e906cb691f21e27559500f1486e1a1aa09aa3f0b7

C:\Users\Admin\AppData\Local\Temp\e4j37F9.tmp_dir1713098297\jre\lib\security\policy\limited\US_export_policy.jar

MD5	01eef8cad0c8f14ccdaa0223a5ce4e61
SHA1	e5a7d04973debf5f482aa8a276e5d80d1c1bba61
SHA256	16993fca9271928bad797f4b8a0becd20f000ea076e98cb5a6c5de30bdea5b8a
SHA512	e1f98d2dbe4986541b3c028d6a645e0ad32f55f1304d75631346e641752791bbd7820962a2caec0b076de11dccee07c8dda27b9ea676a6bee100b393c658183f

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\security\policy\unlimited\i4j8744207720802352245.tmp

MD5	468cdc7f9f92db2a68766aca4b0f454f
SHA1	49205cc918d1d4d593bd4101d0113e47d26b2a24
SHA256	7f2ff373b42c083ee6ecd1480cd29a999f252dd2eab5a0b0e25715b7aa7a5e74
SHA512	fcbc5a97092bd90b7863e4ba957acc81d5cc1ae13ff8b3099abefe89bc536fd8085ed58c25bd94fff7ab3cbf177aff35579510a4b3ef3fe36d29b5a01af4ae01

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\sound.properties

MD5	4f95242740bfb7b133b879597947a41e
SHA1	9afceb218059d981d0fa9f07aad3c5097cf41b0c
SHA256	299c2360b6155eb28990ec49cd21753f97e43442fe8fab03e04f3e213df43a66
SHA512	99fdd75b8ce71622f85f957ae52b85e6646763f7864b670e993df0c2c77363ef9cfce2727badee03503cda41abe6eb8a278142766bf66f00b4eb39d0d4fc4a87

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i4j5135525498128908247.tmp

MD5	19bc5ea849e97624e91a88f71db42e00
SHA1	855b8b4adbc09c05d189fd975da0b4e84275b45f
SHA256	cc9d6a6a7fe17cfaf675840dc5f14af04d9bcfb4f1e1f32d6a9ee65f63ceb2df
SHA512	2dde378947e4ca1a1f8a0c12a747c8885793d827d30234c6787db90ba0f7220b2e56dcbc2b71252079cb06fa018fcc114a9637d9986b10959f79b8c62121ad50

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\lib\i4j882398869476469633.tmp

MD5	62bc9fa21191d34f1db3ed7ad5106efa
SHA1	750cc36b35487d6054e039469039aece3a0cc9e9
SHA256	83755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a
SHA512	af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\LICENSE

MD5	3e0b59f8fac05c3c03d4a26bbda13f8f
SHA1	a4fb972c240d89131ee9e16b845cd302e0ecb05f
SHA256	4b9abebc4338048a7c2dc184e9f800deb349366bdf28eb23c2677a77b4c87726
SHA512	6732288c682a39ed9edf11a151f6f48e742696f4a762c0c7d8872b99b9f6d5ab6c305064d4910b1a254862a873129f11fd0fa56ff11bc577d29303f4fb492673

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\release

MD5	371b3d93ebde133f1c26211cea29dabe
SHA1	cfa020613be665c86a71a3ea5a00cc8399bf6c3e
SHA256	a938ab35f8164a319a576eebde32e99cc51ecad5f310ede705b434a45e7b87dd
SHA512	38d218d00ab6badb2124d8afb7926f68853472da3d1c2ecd7834d018539963f00741bcee184aace9589e7e2b20a588ba11f9c460401758da6376e0dac18bff0b

C:\Users\Admin\AppData\Local\JDownloader 2.0\jre\THIRD_PARTY_README

MD5	37e7aad9c0f238df220f5f70707c6341
SHA1	617ad547d6be8756c859e2770d5301044b0be505
SHA256	ca07b5a7569d691a0c717b6844440aef29706bd81a787c989d95ba352b390f47
SHA512	779ddbe62e28628a6a64b62409377bfcc4afbef917c57ec01f1beda2849890d1fc182620f46a231d5da6850b2dac52d67baec5c02215f309cdec3d5bd3df5fe2

C:\Users\Admin\AppData\Local\JDownloader 2.0\i4j9160556661804161613.tmp

MD5	d410d688481adf28a65de25fb7eaf92f
SHA1	6518fc3a4ecaa1e953aa3742b183ebc1319ef37e
SHA256	9a6cd1c5462c1b5cbe969c6f05cb472690cbe93a6babe9cd72e43b4492b81c77
SHA512	64c89c9a93024571beecd57c4849ec63321f115732f008814532c937a845ecf1b421f454f462c6a65285983d3275da34d57a34075121cd0a5d679ccf1c8ad93d

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\inst_jre.cfg

MD5	bba4b9c4067710f6afca9cbfe1891ca8
SHA1	50955110f444dae19b32fb2359180a85b9146364
SHA256	9adfafd778ecebbdcc022b915ff82c144de6e67ec2ed7eb332e777aa6b316884
SHA512	88cd1bcae52775d7278a330e045e79023c443e7f054193744cfebe9ee38718c95c156a6715cb75f4f301825a2077086d434f116cfa83a364f6512d77f9e21220

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j6450776064699216985.tmp

MD5	f4fbc75c3547ff775553b18c71a1c466
SHA1	428da2c86cf302068d114b149ccdb3176ad0a31e
SHA256	55ab9578f36648cb37ed3802b51c6153466fdad6294e0b465601204b0f454a37
SHA512	de43dc5a888694e20ee257448a3bd6c5c7f8cac3e87c953ab40d5fa148637b7c29224db95d6f72d1e2c15c4f66e49e0ab2a1df9e4a67232c7979f7f08b3024ce

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\[email protected]

MD5	5e164b13ac0b85b81d2c2156bfdfcfa1
SHA1	3cf7bfcd91a6387205c5a8bd0bd14414391465cd
SHA256	85fcf9f08cc62c915213901db70833f9f27c43ddae1cb300f86e7d95008ceffa
SHA512	044f07d29c4a96d0722fde5fc394fe2dee2daee5e06307034344bcceb8e170475a2d302272cf174a890fc521f1dcf27f242f33dec908c40b935166ccc28d4b81

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_9_69g5ss_yklgyb.png

MD5	6217b7a4413a80a72e93606c6b117bc6
SHA1	ea197ee6d9a7c12b0b7746eec5a3fe31c0569f03
SHA256	72003b5441690030673b890cfc5d589c4ac09e6a2e87ec7baec13242e56aa027
SHA512	4200fd7e1cb0a2765e1d1244b314319810d62ae2df33890e3450e9300a92988fc55d3ab554d54bb0770f5917ce3869a3c41ef9dc53e51b8215b1f971605ee176

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_8_69g5ss_18gg8kx_dark.png

MD5	664473b19dfee3431d8b5ae9bb59cb18
SHA1	3792bc1fd6dbc8ffbd004e6b5b5b2fa58420bcd8
SHA256	33e1634875bade353982b041c93e74882cd0c6c3f6ca889bd960c7594d45d333
SHA512	b434489af7d05a305ebc8eebacb21dfa0c2624acdb039b1375a93a8ef843965a5812a3924a3599f196f10bdaa3053e1a4a314d3e57530ec0a5174d076d041563

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_8_69g5ss_18gg8kx@2x_dark.png

MD5	a18de868a92f791889cf1df4c2e4b1ce
SHA1	a5eb5fcd390a1b75e04390d31b96b10fd2abf6a5
SHA256	2c07771b1357391b1b59e7a4d3d64237decd1347da2c6aca85990aad8eb36eca
SHA512	a8abff02d65d7b9a55a509ba426d66bed7884d08cfcc46041c733ce381a53d33d1d7a00c9b43eca1901560de0b05eb1466cebd43e7214baaf2f4446328ed59d8

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_8_69g5ss_18gg8kx.png

MD5	05658e9be759d303893d0af89025fd05
SHA1	55363918316c8f62a9d5b630d6f34b1ce189accc
SHA256	cb52aebf64334395c1eff412def789ec55a18630953a1f69015b501e0dbf87ca
SHA512	af81a046ea5261cd369cdc0d0cb18283675aefe1c4627b36e4872cade143f256e16da276709c4ccf26bf83c9daa179736069158648af4c4f8aef093d1da4192f

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_7_69g5ss_18t4isd.icns

MD5	191c0af8eff5451d7d815e71a142bf20
SHA1	320b77119b1c89285a591746a58272e50bc3eebb
SHA256	d9f65af244d9544d499c6121d8d43493843f1ab5e2df047ade82de5a8a9ffe35
SHA512	55a074b637b477a1a34a60100ee27e2b09bd8dfb63dc4538b58d3f3b3650271b075b995fd64ecac71ae20fe350c9d6c1fd1800895fc7358615033e620c4e2571

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_5_69g5ss_jbdzbb.png

MD5	26b51a4d4ab8d7a7a3f96f555988573a
SHA1	286afff6c4e127b92cd93471e5333feed31a26d8
SHA256	27c22673f9bd706835c6ef95d8d23796873ea82eb80d0d3715b9abec009688d0
SHA512	59cd7e3bc17bc224a43a9afefb95581965236de136b1c22298a046bc1adc665305cc3842811580eafd6739b95d0b42ffc43166360de53d636d9fd3bf712103ae

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_4_69g5ss_1pcd4ys.png

MD5	c7f3e517636414608fe68062894caa6e
SHA1	9b4bdf7de748c52eb7b6cda61c285045e7ee20bd
SHA256	2fe9f283a2c568eba1a35ab23ce2e7a9313d2f5405aa65dc5db723159e910b38
SHA512	2bd67a350c56588a5ec5e38900c3f2b0735c3b8c5184bf8712068287e01712b6f9dad4ea2079cba5b78e962c0ad92fd2ca46714cef948341dc20d826bbb299c3

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_3_69g5ss_1jb375m.png

MD5	d9d9b527ffa9e19db058350223950ffc
SHA1	3751fcb6437671f81cf6bef89597395c518852d9
SHA256	cf2082d9b39edbbb93d9819055085eeb12876058b25c33077a000ea53b5c1d51
SHA512	43828ad5e6c6c25064499b008190bc3160fb56e9dbba06c13dac1fd799c736e5c27f9441804ed6e36da57fbf7e025fe0f7674299235fa0531bc3b92c0436c11b

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j_extf_2_69g5ss_14qfchv.png

MD5	897cbccaa5beeabe003852664eb715d5
SHA1	78564f460483e5141712ccb7d4880a26060b6118
SHA256	95689aef5b4f6ebdf806e4d04f9c5f1cf23c539baed86d9deafcfca607dba7de
SHA512	4672919c0917ce0fa5885fa9af7db06e3f88a4c88884f78992a18a6a5f8be7873c702067d817231c37fc0d8c2faaf7bc84761b0833ab04302446729769ede579

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j5551148425198917578.tmp

MD5	d38f49c7a68d72fd9ed885ebe6415903
SHA1	65e9c2d7c2bb9c0ec1bab0cfab5f228d036b828e
SHA256	e4d91313dd4694993df9057ff320d8b88d8b1d0dac3126f578e0f460f3bc4488
SHA512	d06be34b808cfbc9ca1f308c45fe906f934cbf3a4c8d0787120fa015bd66cb8ef1feba690cd1750d9c37bfe3b8c22e014e7e8f73c9dc6142a1ff809e909a03d1

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\user\i4j2760207748071314636.tmp

MD5	5ffbde70bd6472305015dcbf56e4c2fa
SHA1	8c748a660b5cb9389d20af0e9001ee45f9be86f1
SHA256	790e2a6e5e0b934a3418862f9bec451b3d9ca2f82be3867f2c8931dc350c8fc1
SHA512	e853f2ba7096ce074d7de4d0be4c930c9efa393bd15e9ab0cb1946b2a3e86ee6ac0d931e28a049f1519de0abdbae69b32ddad1d0e91554037f85ea2140e528d4

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j3892990283451169798.tmp

MD5	093865e0679f9d4732684fd1d4051bf5
SHA1	9ba49ad8aa24b284669e32d224cb71a95abdc32b
SHA256	6e35fa0a63e9257ce255e99ce09d109386c58fde86aedd93a8f3951877080b86
SHA512	66332cf0cf7ee9430194e03482ecd51c2e0e73de8489e758e302a4d0a4b0ffa15ba462d967cd5878cab011f0c748fe5d0a3a00ad4044331b6812f446db1f8cde

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\stats.properties

MD5	bc4cbe005a254ef954b9b7dc43ffaf1b
SHA1	75c7f24785ead20b27105238dec71271b12c0222
SHA256	eb1b31793a819c077c0c5b83131ee533e5ede55a230c71717492770d6e5d54eb
SHA512	535b7cde24141c1df7447960a305ee656ed922a0888d5728e860114df87c5838fdb30d95c93064640b756af70b249c9eb281c792d855ade5d4371f94287b71d4

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4jparams.conf

MD5	6e4ec5efdc207b40b3144a857e457bde
SHA1	906940796cc54ea1284359a8b904c73f3fab7d9f
SHA256	6d292188b737fa9161bdd5d653dedaa4910d4b4476b68b1f9292574a23e4fc5a
SHA512	3cba515c22b01a4d7e1f98ee6c6704a2eeed1c7077b65b81e6950a23acff1862cd2a7a3b7583f70c5dd92522c2c632d251541948cf182d29c21865738cab85d7

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\pref_jre.cfg

MD5	1a72896847d31fb0144578dd3c0a16d8
SHA1	1e2fd2f71be2faea2a8fc165f08f0e25a3c8062b
SHA256	197dc971e922b8e08d472d1a1cfb44adb2be0bd7ef352cbeced755c975dbd992
SHA512	c55fb057c351a6acbe2170661e49601508598fc0cc5dde694ffea2ac2387977498777238937a7b746b0e666337fd475d709f9a871e913983bc9175c40c0d965b

C:\Users\Admin\AppData\Local\JDownloader 2.0\.install4j\i4j3259542248478513987.tmp

MD5	f4eac342fbe8c4de974dd183765e6a5a
SHA1	ba7cb95a48bb243292942ebaf41882fdd8c79f76
SHA256	59e201332e806cec2e04f1c888b5c5b4dd5159f72ae77168d138c123dcab5e4b
SHA512	b8f42b2e64e55d905b54770d7ede484b0618238445ba216656f691ac94316d0f3f71be8f4c0635ffac423cd3ac22bdadec9e092b7259eaa82780d25335efccc9

C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe

MD5	143255618462a577de27286a272584e1
SHA1	efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA256	f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
SHA512	c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9

C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe

MD5	d2272f3869d5b634f656047968c25ae6
SHA1	453c6ffa6ec3a0a25ae59a1b58a0d18b023edb16
SHA256	d89a2423da3704108861f190e1633d2100ecc30b4c40bd835ce54a6934887bc9
SHA512	41072ef6f382cf6d4d97ebc2a49a50a9bd41b53508a8586fd8d018e86aed135e8ac2cdd16bbf725e4f74f14ecfcf49789d3af8924b6d5dfa6b94dc6bf79a0785

C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

MD5	9127d7b41e40e77f5badc47f3fb07559
SHA1	2e3282482add3f1fddada5dd5583a1dd43d473b3
SHA256	bbe77cd561c79830873f80d1f7be0652988d20fcc7fcf622e9775f4597283ff6
SHA512	bf56e972a2fc38562c0ab39d0d1d312e58efdad4ee934cce946df288f808c50bff0a11bc9c6c7c5a5acda59694fc08970e8e26c31f821231674059cb085f335e

C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab

MD5	6f97cb1b2d3fcf88513e2c349232216a
SHA1	846110d3bf8b8d7a720f646435909ef80bbcaa0c
SHA256	6a031052be1737bc2767c3ea65430d8d7ffd1c9115e174d7dfb64ad510011272
SHA512	2919176296b953c9ef232006783068d255109257653ac5ccd64a3452159108890a1e8e7d6c030990982816166517f878f6032946a5558f8ae3510bc044809b07

C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

MD5	543ff8d4761d93ad9cfdcb2e147f95c4
SHA1	b0f09836d28d7f2d54b996ead580f8cc1a9b7cd7
SHA256	c51bdbb6588c06ff40ffcabb9aaa7f7669d05f9cab7fda43f07c32ef35391917
SHA512	c631cf4d1df9bfee7cef626f6c7c7b0d5a0b22124ef47977addf48d8a5fa2dd3c101dec3bfa9354aa82cd15f153fb9d2b758f4d7b52d9f469900ac815de66e77

C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

MD5	06c7ea022bc941436ea496fd91396c0f
SHA1	3d890f1feed7a6ef87cc9a9a622d819bc799adb3
SHA256	3959b3d54968d322f894ec314cf2dc9a8be52f3d35bd2e44e8e8f63fd1ff3aed
SHA512	48d15a848592f5f88e7ed77feaf947a580220beae44e845e6e0e17cb9e11f74e0b86accf7cdca8fc8b26b6d1e5f0abdb433f666dc8fbb2bfa579f92334d4797a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	d48222530b3270d93f2541375440e649
SHA1	f6a93dc5b1028c5e945c99d81bb4623bbc48b2b0
SHA256	ed18bb6b2f3939e1e1851f78c9e6ede33edea3030376e1dd874a79498d10fb80
SHA512	c4878c292eededf8ef3e5d695a2f7aa402a803169559f7686fdcabb563028106ddb98f3fdbfba2594c6ed72264486f2689874156182ccf724c9e521a5e9dd0b2

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	672404d129b130de2fa123fbec10449f
SHA1	71166d7b8b5b093fd0b88fedecbfd02c55047d8b
SHA256	1a689475122d75cadaa2132dce3349b9ae5ee4b40a8c8b96c4db7f0fcc710224
SHA512	a242219d9d3e87fd33f6a2f0c364d1cd3cc70d65b5a456e7723a5f4e0a850c3332b48dd8663e49eeaba0d59f16f0a883a6067f0f8ec1dcd23e04664eb87fdbda

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	1a1b1190e8ffcc3a0f2344a486b3a678
SHA1	4c711c764c5f25fc65d07f687a3a55248d875607
SHA256	7a4bfd76926ba6d0fe3f4964d1c3d65964c072532d9bd7cb88117888e8d273db
SHA512	c9498e3fd2ded82508b1e1049656a0ff9c128f11ae7fd943d1cdc246c5c44340a436be78a6c8081d6eb56c12108e09ddb7fc1dd931ab97299d528daba5cfc3f2

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	0e6cb3106f837029920457fe417baff0
SHA1	a0005bf58f34c591b51ef5bd1aa1d416332e45f1
SHA256	53343837aee1b3fd378a9271ce73ce4ceb04f146707e1312d9af7fce91d0478d
SHA512	2b9418ed494947a5a3e0a372fa7f8758f00207a9f07ee33ef5428adce9a4d2dd86dde78d21a1170018439520723b719d8504892945d0d270abec13a40f8ead3b

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	aa5955a2ea5488becb77d3f214582852
SHA1	5c2061edb9bd0b32d0457d580b4ea935aaab2d5f
SHA256	0f6765d9fad580fe8b1a8e93a923a50511f7fa26abb8805bd8d79cba00872bad
SHA512	f74b8df0fca80928ce8beb8720dba26a66809a5526d340fca1cf4f05210d830c7e6f1522c640a2674f14606c65fa1461b7929a0e914602c79e718ab083c1aacb

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	21a6c6ab72237d613c42829e8a31f3a2
SHA1	61131fec11b860e1ffa64f1e3fb7f9d2c17b2975
SHA256	2bdc38d7e31c1cc0e910c36bae40c49f6bc9e8c3001dbffcc0a48202b10cd3eb
SHA512	fcada35fcbb5cd358946b54b55788ceadebddbceb00fc846d822e1cd9fcb35c05b2fb824c9e7f982e97c1ab7f54e9d59afc08dcd9ccf24a153dab47053ad0fe2

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	63e275a0d26e1281f6af97b7b419d691
SHA1	231be2fe9311b0bfbef04fa2cb6861b9205ceb31
SHA256	0df9078c4eca7779b408eb424f2035c4b1a732c1f0be62c608c4cc7aecf6fb98
SHA512	fbd1b508ebe3d4b676c40b04cbc15f82d9d394dc79e0c12a89b660504f080852ac2e7d934686b75eae6f5acc646052e8883cd0c63973f2663fb304a83015db2a

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	0abc379124cb6403342037af5779c45f
SHA1	f98ead35faf40424161e3c3ffb52e0a45b3c3ef6
SHA256	388b0a854a435744a003aa8eb8ad0ef15943606cdf60b91399c2c9e39b5e7a4c
SHA512	a09f0cd91a9c98ddc3a9c2a0144e3cf6413087ddfab10360115425753e4494b72bab38cbe95c641e09d70a64fb79f75a944ece04f7d030c50964b57f3f402aae

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	bb384633302f4aeec7267ea051d2da09
SHA1	84c671c3ee5b17869cfbc204490ef927186d5709
SHA256	076e5a4e362dcd1ad64bceb67c9ed724e2e64704755c023e22924be7b0e85ab7
SHA512	cfcba1b57a31d9c5ef244f6fda184d99236160bb29592946beea061093f9e776bfa19c245b1c27c3454b72a980af4a84913bb52734ca80a3ece0c93a9cebc5f7

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	a037d819b0dbc56fc20d9380caa60fde
SHA1	21efc986cdb5d541e5123b23ccbc147b4965ec8d
SHA256	590d3f44aaa3cf35893766ab89eb8386fee6686ce3e944a63df44a824b92f42b
SHA512	84c5afbbf62a548259bdc6ef19cbeaed4be9e2b5b94ce63851d4d78581e4538a2c65c605300e36f298315f779d9317d218e793f17ba1ca2d419a5ec48199efcb

C:\Program Files\Quick Driver Updater\unins000.exe

MD5	348e9aad9e445392ba5c9fe96daf6f8b
SHA1	e04d450778d05cabb111903892dda0cdb288cd98
SHA256	5bae7f43baa254ce2eba9018e11c575730427d4fdf3146165755cd4bb07c3e53
SHA512	c19e21b4ce0908bd5b0d7f606f6ee44d0b8839ddcab7067933092a707d21131b7379a1850e35475e57be62cba1b61abde61331bd1bccdd875e756bb296f34024

C:\Program Files\Quick Driver Updater\qdu.exe

MD5	dfe06df90a37a45b23e33f510dda9554
SHA1	370edde62c86c1cdae423e966c6e31d5f0bffb58
SHA256	68e15d06d36f57bb45c819e0a3aada7023493bfbea1d2cbd1f3c1f421fe4b546
SHA512	c3a5589006c4e194f2cc7d5c053cd1ddcd4f0a4cdc76d104c0a32c64f0fb0103755523c90e8cba4c3818b49f0b9e144d010d4b97003cf66b9779e0e776220d70

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	7273669848d70bd48cd11c585c3ab5c5
SHA1	381c9d21783ff1e2636f0016b81938aa053d1e81
SHA256	28bca33726bdd38f362a30f4275f957758e99b154a8e852919869d198fb4d38c
SHA512	70aa3fdef5591f6ca9d32c0f890d672d1142a19af645af276181099cac189f50cd0382e5d7d86082eba881b669fa61b559e018ae6fd0d11033417b374abe070c

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	60c8b8457a22b7deaad9afef41600f21
SHA1	c8fee67fc4e633010660d8511895c6a5e861f39c
SHA256	adabc55a2df9c1ec7fbe10c1b3d73b2804c029621d6f6e0332165ac2a2b6f4ab
SHA512	d063541c5e0a01deae45be534e2eea4bb8416fbe5654fd224e4c567f9fbbae96c4d2a3617cbd375719bd43f37d8335bfd4b4660b9b3635ac6770d8f730927608

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	d6d67fdaa5953cb833254a6c67ba3916
SHA1	74ea66fb87f04ec184e72fab1da71054f36eb6b5
SHA256	5cec27afa641002b5af265fbbcbd0c36711065cd579259fb2095e0c462eab14b
SHA512	92402adf907b971dc1a5c887bac1dc1d42e2011fdc68eb775dc3f294bcf1a4a5eb0ada6ca2fa88ab8e7dfc8841eadd70ea454a50b29c7b5deb2155a1afd3f83b

C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

MD5	42d0284ede26919d351ca133e0c34850
SHA1	bf3b380e961cfb50619aa82dd52732f38dee9889
SHA256	1f8888fc1ab84dc453a3f7e0eefec9853d130761779a22fd7b2b90c96bc935de
SHA512	9bdf4aaffb1b7ffe4e2ed984156840f34ae17ef5269bbf5e4f17a90d076222b0803e93f0bddbc64f96a00f88052926149b01b31ba1a8c239b83c069a42e85a3e

C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

MD5	b76cb8282d99b32441b450a0176550fe
SHA1	a7db8d848c8708a6142c83a636d9ec36f754c8d4
SHA256	9bca971d1e77a4f5bcf05482b8119058bc3a00d511d47c73ad0f31adfb22e7b9
SHA512	c7320478137a0904504408c0b9142b8278a3acc1acb706d25dee51384c1bd4aea9696a60a5196fa1e112c75149751f7be9b2256becb7d89e07abe370375beb1d

Sample ID	240414-ppr6zagf48
Target	view
SHA256	d960d813e436aa80a7e1916e61fe5a5d70544a250bbc65809881e83650f68365
Tags	discovery bazarloader dropper loader

Malware Analysis Report

2024-08-06 01:46

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files