Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://github.com/C...

windows10-2004-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    510s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/03/2026, 10:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/SorillusRat
  • Sample260321-l2pptsay3x
Score
10/10
defense_evasiondiscoveryadwindpersistencetrojan

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind
  • Adwind family
    adwind
  • Class file contains resources related to AdWind 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/SorillusRat
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe5efac728,0x7ffe5efac734,0x7ffe5efac740
      2⤵
        PID:5760
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,16724752407948252671,862152042895996975,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2128 /prefetch:3
        2⤵
        • System Time Discovery
        PID:2916
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,4585598022490403592,7272759116838920353,262144 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2096 /prefetch:2
        2⤵
          PID:2824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,16601223991750589173,16509154659452236483,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2612 /prefetch:8
          2⤵
            PID:5892
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,7469780559438711001,12370463969131471481,2097152 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:4228
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,3761610928136654453,6274483185943475375,2097152 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:6140
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,8515208041511024480,16755649242037996087,2097152 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4456 /prefetch:2
                2⤵
                  PID:4684
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,519658549846382658,1740123531630595819,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5328 /prefetch:8
                  2⤵
                    PID:5600
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,2471784234147046344,8019533650995934900,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5744 /prefetch:8
                    2⤵
                      PID:2556
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,16656145381537616583,15723743813567145258,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5900 /prefetch:8
                      2⤵
                        PID:2112
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,8309352061327464805,8525484635387611922,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5764 /prefetch:8
                        2⤵
                          PID:4080
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,18351984912587983978,8530057490056451245,524288 --field-trial-handle=2100,i,10707745578615804991,2352482696029300191,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6012 /prefetch:8
                          2⤵
                            PID:4984
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:4088
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:5344
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:3744
                              • C:\Program Files\7-Zip\7zG.exe
                                "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Sorillus\" -spe -an -ai#7zMap1602:76:7zEvent16226
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:5468
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Sorillus\Start.bat" "
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:988
                                • C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\java.exe
                                  jre1.8.0_361\bin\java.exe -jar -noverify Sorillas.jar
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4420
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                1⤵
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:332
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe5efac728,0x7ffe5efac734,0x7ffe5efac740
                                  2⤵
                                    PID:5136
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,10587253673805603869,1306100601592326999,262144 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1852 /prefetch:2
                                    2⤵
                                      PID:5904
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,8116584738040441011,17166459033877357574,524288 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1940 /prefetch:3
                                      2⤵
                                      • System Time Discovery
                                      PID:5020
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,16237552894566045029,11399765751285908140,524288 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2408 /prefetch:8
                                      2⤵
                                        PID:3484
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,10695145866833543833,1357372466818023808,2097152 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:1
                                        2⤵
                                          PID:2488
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,2101759359040214297,72355875405684662,2097152 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3304 /prefetch:1
                                          2⤵
                                            PID:4428
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,11732844984103379737,15130051282977702926,2097152 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4580 /prefetch:1
                                            2⤵
                                              PID:2236
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,14797537073821630693,11468291481963712416,524288 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5364 /prefetch:8
                                              2⤵
                                                PID:2124
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5648,i,16529393643767456608,7290777694282777448,2097152 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5732 /prefetch:1
                                                2⤵
                                                  PID:2284
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4704,i,11168728772981748109,14948858027429097480,2097152 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5844 /prefetch:1
                                                  2⤵
                                                    PID:4376
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4564,i,17140558788948130859,1524699154963425840,2097152 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5660 /prefetch:1
                                                    2⤵
                                                      PID:6104
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,16832391892474262069,4729193509229881903,524288 --field-trial-handle=1856,i,10120051222518160666,11878215547212708919,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3604 /prefetch:8
                                                      2⤵
                                                        PID:3764
                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                      1⤵
                                                        PID:2288
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                        1⤵
                                                          PID:4968
                                                        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\FapCraft.jar"
                                                          1⤵
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4760
                                                          • C:\Windows\SYSTEM32\attrib.exe
                                                            attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087532890.tmp
                                                            2⤵
                                                            • Views/modifies file attributes
                                                            PID:5972
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087532890.tmp" /f"
                                                            2⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3432
                                                            • C:\Windows\system32\reg.exe
                                                              REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087532890.tmp" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:2752
                                                        • C:\Windows\system32\AUDIODG.EXE
                                                          C:\Windows\system32\AUDIODG.EXE 0x2f0 0x494
                                                          1⤵
                                                            PID:4628
                                                          • C:\Windows\system32\taskmgr.exe
                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                            1⤵
                                                            • Checks SCSI registry key(s)
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2188
                                                          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                            "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\FapCraft.jar"
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1128
                                                            • C:\Windows\SYSTEM32\attrib.exe
                                                              attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087627927.tmp
                                                              2⤵
                                                              • Views/modifies file attributes
                                                              PID:3368
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087627927.tmp" /f"
                                                              2⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:544
                                                              • C:\Windows\system32\reg.exe
                                                                REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087627927.tmp" /f
                                                                3⤵
                                                                • Adds Run key to start application
                                                                PID:4444

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                • Size 40B
                                                                • SHA256 232e203e466db43a7421a3ef94a06ec687029d0a0c24c82e718de22511a118b7
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                BrowsingTopicsState
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                • Size 414B
                                                                • SHA256 d7024b8e3d3c49a9ae8f878c15f838e91e588a8994c514c197e3a0a1f858588c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                f_00002a
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
                                                                • Size 362KB
                                                                • SHA256 1819658e657d7a19299cf197edc4e735659313c0cb56d89d1fe716ba1d397700
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 86ebedae07813074d85c211af019657f1d92725727fa94bba2092ad97a4e300a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 2KB
                                                                • SHA256 c22b994d1d8139fae9dafb0fddb92a3aad689ab4b918278761201ee047c5254f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data_1
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
                                                                • Size 264KB
                                                                • SHA256 96bd2d88f7245ea5440a1cd7324f6a8ec83219c407bdca8b48d80458dc8b2dbb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                • Size 8KB
                                                                • SHA256 954c23c7190685364810bbb8097e7d4b6cd92700610b00347dd8bdeb20bb8e44
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                • Size 3KB
                                                                • SHA256 f555434950de1609d43eba7a6d636156e94920831314e92e9d8b8b8f582cd848
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                TransportSecurity
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                • Size 1KB
                                                                • SHA256 9c71ff908c4d351df2ab4e7af2d780de7aec2b4e9867cc942a43348f75785e1a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                TransportSecurity
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                • Size 2KB
                                                                • SHA256 b96007c48a1a18767110005b852912242302ea4d808e3a41304cf020a62d78c9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                • Size 13KB
                                                                • SHA256 d9feaca69d8074c2c3e7ecbfb88137716fe50e9fc8df480c5afdde3fc7f41a44
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                • Size 12KB
                                                                • SHA256 81520e208df321c7c4011069a3985420d62ab4a52fdd7fd96f4dd492f99958a7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                • Size 12KB
                                                                • SHA256 ff7327b69bb7dcbfb912c5fc5869da6405761abdc725e5c487d7000f15c7ee75
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                • Size 17KB
                                                                • SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                • Size 144B
                                                                • SHA256 31f6310b6f6ff78df723c95c206786510c474d8cbbfdb3b7b5f00c4e4e06ec65
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                • Size 120B
                                                                • SHA256 4236598de5dcedb25aa48c019ff4dc794dd5b9c2720e95a196cd49c75f89c3fb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe58529f.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58529f.TMP
                                                                • Size 96B
                                                                • SHA256 fb302498affcfdc58c319a8bc8f76c2e58dfeb0dfad38bb8e70a6e74c2b688fc
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                0
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\34875408-54e4-4662-932c-22772de62035\0
                                                                • Size 53.7MB
                                                                • SHA256 17477fa14f49955b8a2a91a0c97922cc79452938d793a108d776f10b0b1b6f34
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                • Size 187KB
                                                                • SHA256 e5329d20c2d8dffbd36e74f339a252092c07bc4e5a1e180612afe170c5cff14a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                • Size 90KB
                                                                • SHA256 117477bb5d7ac6c40a5773095d0d5520dcb22ee9238ed8841538d36735a687b3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                • Size 187KB
                                                                • SHA256 98323209b0f452e8ab2937cbcaac38163b44eded308779f2dd2e8ded7d99793b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                • Size 89KB
                                                                • SHA256 02ff79c3e7c508f3c310e40e5782ca458dbf61661a4438237f49f706f0afa69a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                a516bab3-853f-46db-bafa-d62a061c37f5.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a516bab3-853f-46db-bafa-d62a061c37f5.tmp
                                                                • Size 90KB
                                                                • SHA256 fc530a9bb2adadec14a7f7e52d0624cc8c71ac4e80526aaebb2484d7bce28564
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                1774087627927.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1774087627927.tmp
                                                                • Size 11.8MB
                                                                • SHA256 a61dde17c3bacce45076b181b98b40a9895f5e63d3cdcaa6ac653414ea7e3c9d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Sorillas.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\Sorillas.jar
                                                                • Size 10.0MB
                                                                • SHA256 73ab04ed97f75312985e51cb0d7d9b274bc9ecdcd288392469c9e589fcbd64a6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Start.bat
                                                                • Path C:\Users\Admin\Downloads\Sorillus\Start.bat
                                                                • Size 60B
                                                                • SHA256 14748fda6836b077a0301788791753013e3a85f0a41b721c1d874c3f75140066
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                api-ms-win-core-console-l1-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-console-l1-1-0.dll
                                                                • Size 11KB
                                                                • SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-console-l1-2-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-console-l1-2-0.dll
                                                                • Size 11KB
                                                                • SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-datetime-l1-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-datetime-l1-1-0.dll
                                                                • Size 11KB
                                                                • SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-debug-l1-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-debug-l1-1-0.dll
                                                                • Size 11KB
                                                                • SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-errorhandling-l1-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                • Size 11KB
                                                                • SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-file-l1-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-file-l1-1-0.dll
                                                                • Size 14KB
                                                                • SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-file-l1-2-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-file-l1-2-0.dll
                                                                • Size 11KB
                                                                • SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-file-l2-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-file-l2-1-0.dll
                                                                • Size 11KB
                                                                • SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                api-ms-win-core-handle-l1-1-0.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\api-ms-win-core-handle-l1-1-0.dll
                                                                • Size 11KB
                                                                • SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                java.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\java.dll
                                                                • Size 163KB
                                                                • SHA256 5b9b01f1ec06ad559285201cf0907e1c31473f6fb91aa09813dd8f076f94afe3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                java.exe
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\java.exe
                                                                • Size 273KB
                                                                • SHA256 cabcfcf1aebf926bbe03b2aded9e7bbb57f4e10600578a6f2acafbf83b7423d4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msvcp140.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\msvcp140.dll
                                                                • Size 613KB
                                                                • SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                jvm.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\server\jvm.dll
                                                                • Size 8.2MB
                                                                • SHA256 86765f3558ffbb2cf28fb683ee17c288967e636b5cb4fe0422ade39591f6abf4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                vcruntime140.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\vcruntime140.dll
                                                                • Size 83KB
                                                                • SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                verify.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\verify.dll
                                                                • Size 54KB
                                                                • SHA256 a7e7890ec2e238b3108fe2d9b4796898b2fff30ce07957f60689975d7460098c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                zip.dll
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\bin\zip.dll
                                                                • Size 84KB
                                                                • SHA256 d15be64cc05ae14db69b5a3558cd57767eda91e708c74d3dccdc4958c42cb5d9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                jvm.cfg
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\amd64\jvm.cfg
                                                                • Size 634B
                                                                • SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                charsets.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\charsets.jar
                                                                • Size 2.9MB
                                                                • SHA256 c89895405e63110d69bb37178f0650bf2a4a489ab9e98da613464c61c475b58c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                jfxrt.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\ext\jfxrt.jar
                                                                • Size 17.4MB
                                                                • SHA256 0fb07fad0f05706dcdb487ef3fa8adfc97e1a47792ee9cb7af359c77a9393542
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                meta-index
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\ext\meta-index
                                                                • Size 1KB
                                                                • SHA256 f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                win32_LinkNoDrop32x32.gif
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                                • Size 153B
                                                                • SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                jce.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\jce.jar
                                                                • Size 119KB
                                                                • SHA256 81b8de0e148ed3601cf5f1bdf2787c5b15213d842bc537af9ede9635d692b904
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                jfr.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\jfr.jar
                                                                • Size 559KB
                                                                • SHA256 e9eab8ec4712142a3ed9ac833d853e144043699c1712986736f3667a9267c11b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                jsse.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\jsse.jar
                                                                • Size 1.7MB
                                                                • SHA256 784b8df88387ee27383d6db4e184b169a21cb4b8bcb0d8395a7b1ac2b128108a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                meta-index
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\meta-index
                                                                • Size 2KB
                                                                • SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                resources.jar
                                                                • Path C:\Users\Admin\Downloads\Sorillus\jre1.8.0_361\lib\resources.jar
                                                                • Size 3.4MB
                                                                • SHA256 2189d10490922562be379da742eedc5e77cac61a6d2a484a3ed4693965dfe290
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                +JXF1041432118812108617.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\+JXF1041432118812108617.tmp
                                                                • Size 212KB
                                                                • SHA256 e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                +JXF1494103121515982370.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\+JXF1494103121515982370.tmp
                                                                • Size 52KB
                                                                • SHA256 5afafd11dad40cc06023a6a5c1a6793b1cb55720314a18d4352879d6214b014e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                +JXF4930667003128577279.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\+JXF4930667003128577279.tmp
                                                                • Size 217KB
                                                                • SHA256 cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                +JXF5698306610887290334.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\+JXF5698306610887290334.tmp
                                                                • Size 43KB
                                                                • SHA256 a4d9acdd8e2bb188c832059a86636b4b26118d5965f0c08debd2b62c0d63c9a5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                +JXF8531726667492569923.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\+JXF8531726667492569923.tmp
                                                                • Size 164KB
                                                                • SHA256 4e147ab64b9fdf6d89d01f6b8c3ca0b3cddc59d608a8e2218f9a2504b5c98e14
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                button.css1293958019904156035.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\button.css1293958019904156035.tmp
                                                                • Size 758B
                                                                • SHA256 912e4053f404a73cb93525235d34612b6d596c20feb5fbb931efa43500354677
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                clients.css7860836838166769135.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\clients.css7860836838166769135.tmp
                                                                • Size 124B
                                                                • SHA256 8bab80ef1af4a46664abf487b23a3cb3ba2fd083fc06b820089cbd9644a20b78
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                combo_box.css6872624542282898089.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\combo_box.css6872624542282898089.tmp
                                                                • Size 1KB
                                                                • SHA256 f326907999d1a0f5676e49194a6f9111ae1212d3f59224c600e9863735369a85
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                context_menu.css4745177080787598993.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\context_menu.css4745177080787598993.tmp
                                                                • Size 661B
                                                                • SHA256 92d1fa57a3d1a0d518a57a9e74e0e7d0122866d6ca7681aa630853647ede86c6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                dark.css7015430089732630881.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\dark.css7015430089732630881.tmp
                                                                • Size 3KB
                                                                • SHA256 16f48ee307c4bf3f7beaea583a5a9adc8e633034b98b704163ea7e76737cabe9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                general.css3226215053131108872.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\general.css3226215053131108872.tmp
                                                                • Size 1KB
                                                                • SHA256 b80d51557d8d16bca4302e3f7f0d8e6850e835d4778ee80ecff0e98de049ffb0
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                info_knob.css2223194363541489544.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\info_knob.css2223194363541489544.tmp
                                                                • Size 584B
                                                                • SHA256 63eb798090a41d9f58d00d68714a14bc283ae2b6f0aaea40f9f1f212fe56d9ab
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                module_item.css3872321157081024576.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\module_item.css3872321157081024576.tmp
                                                                • Size 155B
                                                                • SHA256 f09f35867470f9fb7d3b9c4f98c4b02fe893fb83ce23c4211b0a688efb4137bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                modules.css6615286434834770338.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\modules.css6615286434834770338.tmp
                                                                • Size 583B
                                                                • SHA256 5682f1b4f1f5e439c268fbaf2aa6ec2060e282c43fe97e9a2daebb4ddc56e843
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                progress_bar.css8272149877355348172.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\progress_bar.css8272149877355348172.tmp
                                                                • Size 253B
                                                                • SHA256 3fdffdea523c0d65fd7f261e7e135ad8475b6fb4355e3d007a3088594a154cfd
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                resize.css108149654856098711.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\resize.css108149654856098711.tmp
                                                                • Size 565B
                                                                • SHA256 40918c842e036dc4c02dc143d4cf5090be7c01dd7810b94f21e72a2d58954fb2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                scroll_pane.css5353208377801973604.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\scroll_pane.css5353208377801973604.tmp
                                                                • Size 1KB
                                                                • SHA256 f89a8d102323d68933531a1d44c5b2a504498af437b37f8ae510d4de91c786c3
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                side_bar.css7954201383902649654.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\side_bar.css7954201383902649654.tmp
                                                                • Size 770B
                                                                • SHA256 8a33cefb03597bba4e46900861d93a0606e6c83c818f6f3ce5cbf84fbc0a0d4b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                slider.css4829314931668106886.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\slider.css4829314931668106886.tmp
                                                                • Size 201B
                                                                • SHA256 d1a98a6648f650be0ed95df7118c8ddbcef07b898b3147ce66bd55d159dab8c8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                split_pane.css6146183556018450684.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\split_pane.css6146183556018450684.tmp
                                                                • Size 222B
                                                                • SHA256 123d0f52e2fe8c239c63060df6c5a3bf4ea116f1d0a60bbfe8a287774114c40d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                table_view.css5741924696204017292.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\table_view.css5741924696204017292.tmp
                                                                • Size 2KB
                                                                • SHA256 43ab12f15a8792c28c993b85f5d9cc6e6375df36ee41bdb08161a9d31c5579e5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                text_area.css8250631983578434399.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\text_area.css8250631983578434399.tmp
                                                                • Size 1KB
                                                                • SHA256 3f27f2ac750e68f82402f83b0f9c8a448fcb3676f41832496107c76d83751ced
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                text_field.css4244525166677758826.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\text_field.css4244525166677758826.tmp
                                                                • Size 399B
                                                                • SHA256 39143bded6438ce26214b97c56fb648f5dfa71f24b4902281788ca62d4f4c7e6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                tooltip.css6319545965452875668.tmp
                                                                • Path C:\Users\Admin\Sorillus\.tmp\tooltip.css6319545965452875668.tmp
                                                                • Size 409B
                                                                • SHA256 e0dbab93951a7529fb7e078f958c854ee5faa9097229aa73762396e9a64faeca
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                memory/3744-410-0x0000018373610000-0x0000018373725000-memory.dmp
                                                                Download

                                                                memory/4420-1890-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1878-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1565-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1573-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1654-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1701-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1720-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1719-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1765-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1766-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1784-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1827-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1831-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1855-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1835-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1864-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1866-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1865-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1872-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1876-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1877-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1880-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1882-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1883-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1574-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1884-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1889-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1885-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1887-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1886-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1881-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1517-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1893-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1901-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1898-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1903-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1905-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1907-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1500-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1911-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-1913-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1474-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1945-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1470-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1376-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1377-0x0000019BDB6A0000-0x0000019BDB6AC000-memory.dmp
                                                                Download

                                                                memory/4420-1306-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1143-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1137-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-1588-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4420-1580-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-2222-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-2188-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-2217-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-2199-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-2200-0x0000019BBF520000-0x0000019BBF521000-memory.dmp
                                                                Download

                                                                memory/4420-2197-0x0000019BC0DF0000-0x0000019BC1DF0000-memory.dmp
                                                                Download

                                                                memory/4420-2214-0x0000019BDACB0000-0x0000019BDB005000-memory.dmp
                                                                Download

                                                                memory/4760-2212-0x000001D6124C0000-0x000001D6124C1000-memory.dmp
                                                                Download

                                                                memory/4760-2209-0x000001D6124C0000-0x000001D6124C1000-memory.dmp
                                                                Download

                                                                memory/4760-2190-0x000001D6124C0000-0x000001D6124C1000-memory.dmp
                                                                Download

                                                                memory/4760-2179-0x000001D6124C0000-0x000001D6124C1000-memory.dmp
                                                                Download

                                                                memory/5468-1072-0x000001DCFDA60000-0x000001DCFDDB5000-memory.dmp
                                                                Download