4f536911b2d46ececa07175e0e0db5178855029d6155821dbb7ff1b2b5471d70

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
10/12/2025, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_4f536911b2d46ececa07175e0e0db5178855029d6155821dbb7ff1b2b5471d70.jar
Size 31KB
Sample251210-jbcapswnbz
SHA256 4f536911b2d46ececa07175e0e0db5178855029d6155821dbb7ff1b2b5471d70
MD5 1a94f262fd68d80ee4a50de8ac2eb6a1
SHA1 2d5131369d25b7c020ec84e57609b9555109e238
SHA512 c8e6054d901cb1bacee56dac3da04e96494bdd42d8c238ff191c66209604bcb03fd471f1f4e7962c77563f494a1d8d4a1b203476adf081a80d46adb1272c3c8e
SSDEEP 768:Q8ar+BvMSVaTEUSuAv2eC3tOX8w2KYUZ7nwp+pE0pbAimPJZu:qSxVaIUFN3YYUZsQpbLmPJg
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

credential_access defense_evasion discovery execution persistence stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
380	powershell.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4932	chrome.exe
4036	chrome.exe
1904	chrome.exe
1468	chrome.exe
4892	chrome.exe
1284	msedge.exe
2704	msedge.exe
3572	msedge.exe

Loads dropped DLL 5 IoCs

pid	Process
4444	java.exe
4768	java.exe
5256	chrome.exe
4768	java.exe
5860	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\javacom = "C:\\Users\\Admin\\AppData\\Roaming\\AutoStartMini\\javacom-run.bat"	reg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
2788	TASKKILL.exe
3552	TASKKILL.exe
4720	taskkill.exe
1736	taskkill.exe
2804	taskkill.exe
396	taskkill.exe
5708	TASKKILL.exe
4004	taskkill.exe
5320	taskkill.exe
3420	taskkill.exe
4316	TASKKILL.exe
2208	taskkill.exe
1060	taskkill.exe
4312	taskkill.exe
4912	taskkill.exe
1528	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
380	powershell.exe
380	powershell.exe
4932	chrome.exe
4932	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	5320	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	4316	TASKKILL.exe
Token: SeDebugPrivilege	5708	TASKKILL.exe
Token: SeDebugPrivilege	2788	TASKKILL.exe
Token: SeDebugPrivilege	3552	TASKKILL.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeDebugPrivilege	4720	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	msedge.exe
4932	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4444	2620	java.exe	79
PID 2620 wrote to memory of 4768	2620	java.exe	81
PID 4768 wrote to memory of 2160	4768	java.exe	83
PID 4768 wrote to memory of 5632	4768	java.exe	85
PID 5632 wrote to memory of 4912	5632	cmd.exe	87
PID 4768 wrote to memory of 6120	4768	java.exe	89
PID 6120 wrote to memory of 5320	6120	cmd.exe	91
PID 4768 wrote to memory of 5104	4768	java.exe	92
PID 4768 wrote to memory of 4704	4768	java.exe	94
PID 5104 wrote to memory of 3528	5104	cmd.exe	95
PID 4768 wrote to memory of 4056	4768	java.exe	97
PID 4704 wrote to memory of 1736	4704	cmd.exe	98
PID 4768 wrote to memory of 2568	4768	java.exe	99
PID 2568 wrote to memory of 3420	2568	cmd.exe	101
PID 4768 wrote to memory of 3140	4768	java.exe	102
PID 3140 wrote to memory of 2804	3140	cmd.exe	104
PID 4056 wrote to memory of 380	4056	javaw.exe	105
PID 4768 wrote to memory of 5800	4768	java.exe	107
PID 5800 wrote to memory of 1528	5800	cmd.exe	109
PID 4768 wrote to memory of 5256	4768	java.exe	111
PID 4768 wrote to memory of 5860	4768	java.exe	114
PID 380 wrote to memory of 5336	380	powershell.exe	116
PID 4768 wrote to memory of 4316	4768	java.exe	118
PID 4768 wrote to memory of 1284	4768	java.exe	120
PID 1284 wrote to memory of 5016	1284	msedge.exe	121
PID 1284 wrote to memory of 4588	1284	msedge.exe	122
PID 1284 wrote to memory of 2884	1284	msedge.exe	123
PID 1284 wrote to memory of 2884	1284	msedge.exe	123
PID 1284 wrote to memory of 2884	1284	msedge.exe	123
PID 1284 wrote to memory of 2548	1284	msedge.exe	124
PID 1284 wrote to memory of 2548	1284	msedge.exe	124
PID 1284 wrote to memory of 3572	1284	msedge.exe	125
PID 1284 wrote to memory of 3572	1284	msedge.exe	125
PID 1284 wrote to memory of 3572	1284	msedge.exe	125
PID 1284 wrote to memory of 2704	1284	msedge.exe	126
PID 1284 wrote to memory of 2704	1284	msedge.exe	126
PID 1284 wrote to memory of 2704	1284	msedge.exe	126
PID 4768 wrote to memory of 5708	4768	java.exe	129
PID 4768 wrote to memory of 2788	4768	java.exe	131
PID 4768 wrote to memory of 4932	4768	java.exe	133
PID 4932 wrote to memory of 5308	4932	chrome.exe	134
PID 4932 wrote to memory of 4708	4932	chrome.exe	135
PID 4932 wrote to memory of 4708	4932	chrome.exe	135
PID 4932 wrote to memory of 4716	4932	chrome.exe	136
PID 4932 wrote to memory of 3700	4932	chrome.exe	137
PID 4932 wrote to memory of 3700	4932	chrome.exe	137
PID 4932 wrote to memory of 1468	4932	chrome.exe	138
PID 4932 wrote to memory of 4036	4932	chrome.exe	139
PID 4932 wrote to memory of 1468	4932	chrome.exe	138
PID 4932 wrote to memory of 4036	4932	chrome.exe	139
PID 4932 wrote to memory of 1904	4932	chrome.exe	141
PID 4932 wrote to memory of 1904	4932	chrome.exe	141
PID 4932 wrote to memory of 4892	4932	chrome.exe	142
PID 4932 wrote to memory of 4892	4932	chrome.exe	142
PID 4768 wrote to memory of 3552	4768	java.exe	143
PID 4768 wrote to memory of 5404	4768	java.exe	145
PID 5404 wrote to memory of 396	5404	cmd.exe	147
PID 4768 wrote to memory of 2112	4768	java.exe	148
PID 2112 wrote to memory of 4004	2112	cmd.exe	150
PID 4768 wrote to memory of 5272	4768	java.exe	151
PID 5272 wrote to memory of 2208	5272	cmd.exe	153
PID 4768 wrote to memory of 2564	4768	java.exe	154
PID 2564 wrote to memory of 1060	2564	cmd.exe	156
PID 4768 wrote to memory of 2736	4768	java.exe	157

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\_4f536911b2d46ececa07175e0e0db5178855029d6155821dbb7ff1b2b5471d70.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\discord37149380399598155.jar
  2⤵
  - Loads dropped DLL
  PID:4444
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\downloaded4027611922982770980.jar 1377085792341721188======================================================================================= Click Click Click 6662
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:2160
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM chrome.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM browser.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM browser.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javacom" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AutoStartMini\javacom-run.bat" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javacom" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AutoStartMini\javacom-run.bat" /f
      4⤵
      Adds Run key to start application
      PID:3528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM brave.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM brave.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar C:\Users\Admin\AppData\Roaming\JavaInstaller\JavaInt.jar 1377085792341721188
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Start-Process -WindowStyle Hidden -WorkingDirectory 'C:\Users\Admin\AppData\Roaming\JavaInstaller' -FilePath 'C:\Program Files\Java\jre-1.8\bin\java.exe' -ArgumentList '-jar','C:\Users\Admin\AppData\Roaming\JavaInstaller\Site.jar', '1377085792341721188'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Program Files\Java\jre-1.8\bin\java.exe
        
        "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Roaming\JavaInstaller\Site.jar 1377085792341721188
        5⤵
        
        PID:5336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM msedge.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM msedge.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM opera.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM opera.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM vivaldi.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM vivaldi.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Loads dropped DLL
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Loads dropped DLL
    PID:5860
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ff96946f208,0x7ff96946f214,0x7ff96946f220
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2024,i,17493913823082521880,13971135543684495056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1972,i,17493913823082521880,13971135543684495056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2740,i,17493913823082521880,13971135543684495056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3580,i,17493913823082521880,13971135543684495056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3596,i,17493913823082521880,13971135543684495056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2704
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5708
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff97830dcf8,0x7ff97830dd04,0x7ff97830dd10
      4⤵
      PID:5308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1936,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1928 /prefetch:2
      4⤵
      PID:4708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2208,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      PID:4716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2608,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2604 /prefetch:13
      4⤵
      PID:3700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3468,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3520,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4204,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4200 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:1904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4580,i,14416599122484799212,15255350339275196002,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4892
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM chrome.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:396
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM browser.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM browser.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM brave.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5272
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM brave.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM msedge.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM msedge.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM opera.exe /F"
    3⤵
    PID:2736
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM opera.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM vivaldi.exe /F"
    3⤵
    PID:4160
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM vivaldi.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4312

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:688

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\JavaInstaller\JavaInt.jar" 1377085792341721188
1⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4224

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 188540ab13080a8f6f21d0524872bf9730ad267729bcd9d1b0824de6ff4e2e55
MD5 e3de15389dfbdcb4b60dfa4d806b7bd4
SHA1 d85e44975333f50622e952eae4a53a1c8482111a
SHA512 99f2b60031da73fbb61242f6218bddae54b662a4b3c5c443d96e2fe8c1abcea6fa2b20032d66894f8c34c4150f172096be80aebf967c952cb93f25ea91e3962a
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 22e7030d110f1235b4ff5dd7e7def48e9ec2bb7ec4c6d9cc6c18d5d54c2ab542
MD5 76b54d5979904818c084036c75ded603
SHA1 e1532604113261887d96c8f77ad65730f0f29944
SHA512 7e2e8ae8195fe48b71868b2719e9204b527a09dc8d1499d7619fab306b9588cb7acedf43d3c33a1f1230df69a3c42ff424586c5f533a1a50262316ffb6977c7e
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7ee952ce7180d220d90b1907942cf6ff70893832d35cc9aaddea6a103a4034ac
MD5 c5eed5bdb8981a3384c283214e49ef06
SHA1 8c7494799dc456dd9b4862ff87b1c1216d7755bd
SHA512 c12c132444bd674be9da4fb94f5ed8b27e69373a8e297b7d8ee51886743f91fdc5fc93fa7e836cdfdf1760687b809888afe12a76c6421b0811777a5a7331904d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 2a5b2c43cfd50daa18a9197d654c7e62e6d4e0f16543481fb61713131c7b5b1c
MD5 235f4d8ae960dcade210bcce70bd8073
SHA1 05f50bf3f5a0d027ae794b20c0f9da831f917d04
SHA512 4cc81f0dcf3103401520f849d4b4f85687b51a17f90078e79536708bb747fb15c33626fe765e2200eb46505aab50fde2c985ab1a29dd2dec6d5469e49c127f2e
SSDEEP 1536:2jXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMW:wXjM4rTmN5eWvStRNoV8cWK7XF+TwMW
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e373291cec4f23986133c23daa353551f05eda26aac4a4e3686c40f8bfda576e
MD5 03b6ceee6d3294b477cb96be0a4821a2
SHA1 17508a8b887dac0d5b2fdf62cce6ee7989564165
SHA512 581fbd959baff647df5ac757c03b071653bca94c529807775b30e0f4b88ade1f0dd99850daaea1fa0861ce83d3e9d505a004e6c78d45e923ee39728a2d9efda9
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a612ab9-2a45-47f2-8d6e-78ba2dd2d53b\index-dir\the-real-index
Size 1KB
SHA256 a05357c328e49fd934550bf616ed05b2a79db8cbf93fbe2b65db2df2e26cca04
MD5 dc7861013d0cccff9fea9a582c5cda1a
SHA1 74b99b18d721ae193dc463dfd3ad73f76362da43
SHA512 d7370921a58e628210c54f4930c4d33a22f8a5a4456e00a162ea627498bdc6e32725a21e3c943dee7002db2e36b034c7912f18f5d657d2f42e871c2c0317ab51
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c534.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a612ab9-2a45-47f2-8d6e-78ba2dd2d53b\index-dir\the-real-index~RFe57c534.TMP
Size 1KB
SHA256 d65814e969264917ddfa12f0c3980d66a5acd287675a70805e5fc30e12e0c153
MD5 e98c72ae5e7252d40207c99e7ec51d19
SHA1 0cc10a94674f8aee37f6879d6f8047689b804135
SHA512 026836bfc7a2bbabb196229923aa738f148e3faad0424acf56d553d8b85708183ff0a70e7302827f5d0dab6d76fa07822afdc5cb69dd1bfaaab99e3d6bfc386a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fb8ac1e19fd0574d24ef00688ec8f7d713d8d1b2d6cd3172d777756273c35ea0
MD5 c43e09bbe5bacb23d4117279df6c02e3
SHA1 c5e4f02da537bc3a7d321bb8a5d69f27a623a9c1
SHA512 63804bac34f7653714b4abee3d0963193e0ccc4d83275c80c08649686253b91105887ccbdd082b6defeac476d6144030ac2fa0a7274a5c771e90b98ec4b9e6f9
SSDEEP 768:6FiE6esE8lDldUGz3UCgNFB2TwdwZM6MKAO9PejovGqsW7iIKu8CE1x4L:beB85d730QMK/kWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8ac35521791facdd488c0a3928ea5b2704daafca82b99bd79c149b0ecd8e00c7
MD5 604806d902558746ab21b1c8721231c7
SHA1 f309feaee39e583bf46facd1d4b6684a9cd65604
SHA512 cdf747d314954855ef778ddcba537d863ced1a07d27f6b9453cf1510f39948aefdaa395695aee6071a27970e50f19127a244a6b27d4bc5f4a498c0adddeb5675
SSDEEP 768:OFiE6esE8lDldUGz3UCg3X2TwdwZvGqoYGZovGqsW7iIKu8CE1x4L:3eB85d733GqCZWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_up32nxgs.5mz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_up32nxgs.5mz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

discord37149380399598155.jar

Path C:\Users\Admin\AppData\Local\Temp\discord37149380399598155.jar
Size 3.3MB
SHA256 96952ba44ae8ea88bd6298e82ba33df37bb8d95a95f0b523a829a2c2de9879d9
MD5 7aa1d8a103b5c5b9fc36301270b980b9
SHA1 223c24fa3a657522debd7dc2301199a940e3a4c5
SHA512 7c7ba32471ccd3cf57f97b503632ef66085da882203f9d9bb172643d4359ed9256b401b797de5c8bc3a4a11e0c4031c1d7e5c875747542964f1fd6b88078ba23
SSDEEP 98304:oHNILeeE+l1sS3zDh/lY2CudGssoG79TtIwe7M6WJhbmd:otgg+lPjdlY2CA2oGpT+u6WLmd
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaded4027611922982770980.jar

Path C:\Users\Admin\AppData\Local\Temp\downloaded4027611922982770980.jar
Size 21.6MB
SHA256 8c272d62c9757902fa945b95baf703f16869183d2b55ee5c6d6dc1437b4db6af
MD5 8d9eebcf9486ebdab24848b0da3daa58
SHA1 a01ff76d900d0be1c66692bbc54d516dc702de4c
SHA512 de7b19bc59b513c329ca9b0917ff4041997850348aeec6ad99729f7fd3202c5ba72dd0a2b442b9bc367380b1b6cb92bc7392028ecf8ddd87a75dcce6be7a5056
SSDEEP 393216:sEIFDVFLYdDpnkeQzQFepWA6zULoOupcspNoaAGJ3j59aUm8Wql40:kFLYdDpkdiXdqM5AG5O30
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna8760786278414483707.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8760786278414483707.dll
Size 248KB
SHA256 13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03
MD5 34d12b1e2af72d9bb267bbc8c0d53e4a
SHA1 d9ed8776645f6b4f52df16132450863c47ea92d7
SHA512 c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10
SSDEEP 6144:9RW+uZb5K8Dy+Zkt9dHlJ1ybBEleb906aslm/mFyygW:9RW+MbMOEe3Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna9007621669871838040.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna9007621669871838040.dll
Size 229KB
SHA256 cf8e552ee05cb0e872797ecffe0f9d3dc67e513748f3cd957f79e0f2f3d66ac2
MD5 cfebe457d00a97c2c5f8930bdbaae1f0
SHA1 526e95d2afde5ef07dd0aca671261dfbc7fcfa17
SHA512 fbded4dc03011e58219f622e724c0737475ce95a1a3619ca5e68babe5b734afc664523e93f96047e20d4d82411ccace0bac42f1dc77a2da2f94886ba04fab8a0
SSDEEP 3072:gTD0CYjMP9JCy+kveYFmAst0BpwekWV/5SZw1VVOeVDslm/m6yGfx:sOM9JCxk2QsyrKWRrslm/m6yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

moddll3784139081703587978.dll

Path C:\Users\Admin\AppData\Local\Temp\moddll3784139081703587978.dll
Size 36KB
SHA256 ec1a4674c22e88038a5dc21bcf8e9b7a1718f00df711a6cd13ba3eb021017a7d
MD5 36d3d32d69d5745939583d12f5a28445
SHA1 1ed261233dbb9484a6589b420bcb7b5b588b115b
SHA512 f714511449fb405a2a0579ebdee2269b103aae1f54bed3be77bab752c851c761649bcb6457285ebeb57bf31852e0d5adfe832239e3463e0c1d53aa4a7b81ba59
SSDEEP 768:MEXRIrKClhXeN7J+MiF6wJSNluMMfzsygsx:TBGKClhBUegFMfzcsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite-3.45.3.0-96336585-6275-4589-bb7a-2d2cea7d5af4-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.45.3.0-96336585-6275-4589-bb7a-2d2cea7d5af4-sqlitejdbc.dll
Size 947KB
SHA256 14dee990e031f70c879d5b1b07dc1f8e077952db51e3bb37282f37684f06e18d
MD5 fc683f23febf5492ce94521b369014a8
SHA1 8b72934bf6d8885cdcbf028867d83b1f89ad1b21
SHA512 f022f19763d5d27160826da4b93c1c5eabc0c7f61fd1f39f4bcca3a5d16f721fec6fcf5bf78ea8691a190dcece6848c33e7f51777f6b8812aadec98cdf311f56
SSDEEP 24576:5iGt+jeMSQXL9Ev84DfQXgLlzpqOHN8WaI:1ZnQb9Evj5vqOHNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavaInt.jar

Path C:\Users\Admin\AppData\Roaming\JavaInstaller\JavaInt.jar
Size 20KB
SHA256 74ae055e77296ab32152fe06983d63046ef31d4335ff05b109f27af3ef438cc4
MD5 2f8c264728f92c3a76a910f02033eece
SHA1 fabb8cf5b9abb7f3a920a7e69fbfc378caba7c61
SHA512 bf5f25ec9c33cc4883cdadb5e968f2e1e499d06dc6a78dfc3a47afdb6be0c51ca8e3d18e4ee3e8797887e9731450a596a117d40d91bc04dfe62c2e877889b1d1
SSDEEP 384:JHcZeoo/zxDwuKX6yGYnmAsFz6VCB9Y5DXEpZgkVMlRe8Sx4K:JaAlDwPIYnmASzWlpaJ3xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_b3287d62-80ff-441f-921b-4650c01c2c1a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1418876453-2228697459-2788511057-1000\83aa4cc77f591dfc2374580bbd95f6ba_b3287d62-80ff-441f-921b-4650c01c2c1a
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/380-256-0x0000022AFC770000-0x0000022AFC792000-memory.dmp

Download

memory/1868-359-0x000001E06AEF0000-0x000001E06AEF1000-memory.dmp

Download

memory/1868-683-0x000001E06AEF0000-0x000001E06AEF1000-memory.dmp

Download

memory/2620-86-0x00000230D5750000-0x00000230D5760000-memory.dmp

Download

memory/2620-131-0x00000230D5790000-0x00000230D57A0000-memory.dmp

Download

memory/2620-59-0x00000230D5780000-0x00000230D5790000-memory.dmp

Download

memory/2620-58-0x00000230D56E0000-0x00000230D56F0000-memory.dmp

Download

memory/2620-60-0x00000230D56F0000-0x00000230D5700000-memory.dmp

Download

memory/2620-61-0x00000230D5790000-0x00000230D57A0000-memory.dmp

Download

memory/2620-64-0x00000230D57A0000-0x00000230D57B0000-memory.dmp

Download

memory/2620-63-0x00000230D5700000-0x00000230D5710000-memory.dmp

Download

memory/2620-67-0x00000230D5710000-0x00000230D5720000-memory.dmp

Download

memory/2620-70-0x00000230D5720000-0x00000230D5730000-memory.dmp

Download

memory/2620-69-0x00000230D57C0000-0x00000230D57D0000-memory.dmp

Download

memory/2620-68-0x00000230D57B0000-0x00000230D57C0000-memory.dmp

Download

memory/2620-74-0x00000230D57D0000-0x00000230D57E0000-memory.dmp

Download

memory/2620-73-0x00000230D5730000-0x00000230D5740000-memory.dmp

Download

memory/2620-77-0x00000230D57E0000-0x00000230D57F0000-memory.dmp

Download

memory/2620-76-0x00000230D5740000-0x00000230D5750000-memory.dmp

Download

memory/2620-79-0x00000230D53F0000-0x00000230D53F1000-memory.dmp

Download

memory/2620-2-0x00000230D5410000-0x00000230D5680000-memory.dmp

Download

memory/2620-87-0x00000230D57F0000-0x00000230D5800000-memory.dmp

Download

memory/2620-88-0x00000230D53F0000-0x00000230D53F1000-memory.dmp

Download

memory/2620-54-0x00000230D56D0000-0x00000230D56E0000-memory.dmp

Download

memory/2620-742-0x00000230D5690000-0x00000230D56A0000-memory.dmp

Download

memory/2620-51-0x00000230D5760000-0x00000230D5770000-memory.dmp

Download

memory/2620-93-0x00000230D5760000-0x00000230D5770000-memory.dmp

Download

memory/2620-104-0x00000230D53F0000-0x00000230D53F1000-memory.dmp

Download

memory/2620-743-0x00000230D56A0000-0x00000230D56B0000-memory.dmp

Download

memory/2620-50-0x00000230D56C0000-0x00000230D56D0000-memory.dmp

Download

memory/2620-45-0x00000230D56B0000-0x00000230D56C0000-memory.dmp

Download

memory/2620-744-0x00000230D56B0000-0x00000230D56C0000-memory.dmp

Download

memory/2620-115-0x00000230D5770000-0x00000230D5780000-memory.dmp

Download

memory/2620-745-0x00000230D56C0000-0x00000230D56D0000-memory.dmp

Download

memory/2620-746-0x00000230D56D0000-0x00000230D56E0000-memory.dmp

Download

memory/2620-119-0x00000230D5780000-0x00000230D5790000-memory.dmp

Download

memory/2620-751-0x00000230D5410000-0x00000230D5680000-memory.dmp

Download

memory/2620-55-0x00000230D5770000-0x00000230D5780000-memory.dmp

Download

memory/2620-752-0x00000230D5730000-0x00000230D5740000-memory.dmp

Download

memory/2620-130-0x00000230D53F0000-0x00000230D53F1000-memory.dmp

Download

memory/2620-25-0x00000230D56E0000-0x00000230D56F0000-memory.dmp

Download

memory/2620-46-0x00000230D5750000-0x00000230D5760000-memory.dmp

Download

memory/2620-136-0x00000230D57A0000-0x00000230D57B0000-memory.dmp

Download

memory/2620-753-0x00000230D5740000-0x00000230D5750000-memory.dmp

Download

memory/2620-42-0x00000230D5740000-0x00000230D5750000-memory.dmp

Download

memory/2620-754-0x00000230D5750000-0x00000230D5760000-memory.dmp

Download

memory/2620-161-0x00000230D57C0000-0x00000230D57D0000-memory.dmp

Download

memory/2620-160-0x00000230D57B0000-0x00000230D57C0000-memory.dmp

Download

memory/2620-755-0x00000230D57F0000-0x00000230D5800000-memory.dmp

Download

memory/2620-747-0x00000230D56E0000-0x00000230D56F0000-memory.dmp

Download

memory/2620-748-0x00000230D56F0000-0x00000230D5700000-memory.dmp

Download

memory/2620-213-0x00000230D57D0000-0x00000230D57E0000-memory.dmp

Download

memory/2620-749-0x00000230D5700000-0x00000230D5710000-memory.dmp

Download

memory/2620-750-0x00000230D5710000-0x00000230D5720000-memory.dmp

Download

memory/2620-41-0x00000230D56A0000-0x00000230D56B0000-memory.dmp

Download

memory/2620-249-0x00000230D57E0000-0x00000230D57F0000-memory.dmp

Download

memory/2620-741-0x00000230D5680000-0x00000230D5690000-memory.dmp

Download

memory/2620-33-0x00000230D5410000-0x00000230D5680000-memory.dmp

Download

memory/2620-34-0x00000230D5710000-0x00000230D5720000-memory.dmp

Download

memory/2620-37-0x00000230D5690000-0x00000230D56A0000-memory.dmp

Download

memory/2620-38-0x00000230D5730000-0x00000230D5740000-memory.dmp

Download

memory/2620-740-0x00000230D5720000-0x00000230D5730000-memory.dmp

Download

memory/2620-739-0x00000230D53F0000-0x00000230D53F1000-memory.dmp

Download

memory/2620-35-0x00000230D5720000-0x00000230D5730000-memory.dmp

Download

memory/2620-11-0x00000230D53F0000-0x00000230D53F1000-memory.dmp

Download

memory/2620-13-0x00000230D5680000-0x00000230D5690000-memory.dmp

Download

memory/2620-15-0x00000230D5690000-0x00000230D56A0000-memory.dmp

Download

memory/2620-17-0x00000230D56A0000-0x00000230D56B0000-memory.dmp

Download

memory/2620-36-0x00000230D5680000-0x00000230D5690000-memory.dmp

Download

memory/2620-19-0x00000230D56B0000-0x00000230D56C0000-memory.dmp

Download

memory/2620-22-0x00000230D56C0000-0x00000230D56D0000-memory.dmp

Download

memory/2620-29-0x00000230D5700000-0x00000230D5710000-memory.dmp

Download

memory/2620-23-0x00000230D56D0000-0x00000230D56E0000-memory.dmp

Download

memory/2620-27-0x00000230D56F0000-0x00000230D5700000-memory.dmp

Download

memory/2620-353-0x00000230D57F0000-0x00000230D5800000-memory.dmp

Download

memory/4056-355-0x000001E66FAD0000-0x000001E66FAD1000-memory.dmp

Download

memory/4056-345-0x000001E66FAD0000-0x000001E66FAD1000-memory.dmp

Download

memory/4444-128-0x000001826FC30000-0x000001826FC40000-memory.dmp

Download

memory/4444-127-0x000001826F9C0000-0x000001826FC30000-memory.dmp

Download

memory/4444-94-0x000001826F9C0000-0x000001826FC30000-memory.dmp

Download

memory/4444-105-0x000001826F9A0000-0x000001826F9A1000-memory.dmp

Download

memory/4444-116-0x000001826FC30000-0x000001826FC40000-memory.dmp

Download

memory/4444-126-0x000001826F9A0000-0x000001826F9A1000-memory.dmp

Download

memory/4444-120-0x000001826FC40000-0x000001826FC50000-memory.dmp

Download

memory/4444-129-0x000001826FC40000-0x000001826FC50000-memory.dmp

Download

memory/4768-592-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-247-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-287-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-467-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-315-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-465-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-511-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-464-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-336-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-309-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-419-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-416-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-274-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-645-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-646-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-651-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-666-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-665-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-275-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-684-0x0000020A3CD00000-0x0000020A3CF70000-memory.dmp

Download

memory/4768-711-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-721-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-725-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-737-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-738-0x0000020A3CD00000-0x0000020A3CF70000-memory.dmp

Download

memory/4768-276-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-272-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-488-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-214-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-209-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-200-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-196-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-191-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-147-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/4768-137-0x0000020A3CD00000-0x0000020A3CF70000-memory.dmp

Download

memory/4768-286-0x0000020A3B3F0000-0x0000020A3B3F1000-memory.dmp

Download

memory/5336-763-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-770-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-620-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-765-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-386-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-466-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-758-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-760-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-626-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-448-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-603-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-773-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-777-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-778-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-780-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-785-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-793-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-795-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download

memory/5336-804-0x00000170C9250000-0x00000170C9251000-memory.dmp

Download