adwind | 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019

Resubmissions

07/10/2026, 08:17

261007-j649zaws6l10

07/10/2026, 08:09

261007-j2dlfsv17l10

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe.jar
Size 570KB
Sample261007-j2dlfsv17l
SHA256 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019
MD5 31f90d8a8a473074bfeef7972d5a39b2
SHA1 083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd
SHA512 bc8abbfba825303e38ed4a29d72af2a1f6d54592a14e53807defb0d24326ab540645e7b69f4fe5b79e9e3bb4dc10e5fda0281e852443700feea512db7654dc68
SSDEEP 12288:JME6KYOW/U7JA1T7hyiGuwtjXOi8KyI/qroUIRMZNmkq0pT8Kiy4:3YOAU1A1pULOi8Ky4qrohMZNuET8D
TLSH
T115C41207FEE8843DE8338A349D93D0727D462DED9C2A916B58560AD04A64C6F8F274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution adwind persistence trojan

Malware Config

Signatures

Family: AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000246b3-1031.dat	family_adwind1

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERDelete.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBPIMSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSvcHost.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Proxy.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nbrowser.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filwscc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Main.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamscan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SASTask.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSUpdate64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiSSLVPNdaemon.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LittleHook.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSSVC.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff_x64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psview.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANNER.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	regedit.exe

Executes dropped EXE 2 IoCs

pid	Process
4704	javaw.exe
876	java.exe

Loads dropped DLL 24 IoCs

pid	Process
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
4704	javaw.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
876	java.exe
4704	javaw.exe
876	java.exe
4704	javaw.exe
4704	javaw.exe
876	java.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NYRZDOmEJZd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\xmpCzqQrOmL\\LPZiwaCeIRf.jcCGXp\""	reg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs

execution

Visual Basic

T1059.005

pid	Process
4984	cscript.exe
5028	cscript.exe
4504	cscript.exe
964	cscript.exe
2352	cscript.exe
980	cscript.exe
5104	cscript.exe
3972	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1616	cmd.exe
5092	cmd.exe
1652	cmd.exe
4288	cmd.exe
4188	cmd.exe
4836	cmd.exe
1160	cmd.exe
5044	cmd.exe
2616	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2112	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
436	taskkill.exe
6024	taskkill.exe
5332	taskkill.exe
5740	taskkill.exe
5824	taskkill.exe
996	taskkill.exe
1848	taskkill.exe
5204	taskkill.exe
5812	taskkill.exe
4148	taskkill.exe
5136	taskkill.exe
4384	taskkill.exe
116	taskkill.exe
112	taskkill.exe
5588	taskkill.exe
5964	taskkill.exe
5272	taskkill.exe
5276	taskkill.exe
2092	taskkill.exe
4832	taskkill.exe
4612	taskkill.exe
884	taskkill.exe
2380	taskkill.exe
5548	taskkill.exe
6120	taskkill.exe
5864	taskkill.exe
540	taskkill.exe
600	taskkill.exe
4384	taskkill.exe
5484	taskkill.exe
560	taskkill.exe
3132	taskkill.exe
436	taskkill.exe
1472	taskkill.exe
1776	taskkill.exe
5972	taskkill.exe
1056	taskkill.exe
3540	taskkill.exe
3024	taskkill.exe
1960	taskkill.exe
5760	taskkill.exe
4464	taskkill.exe
228	taskkill.exe
3580	taskkill.exe
5644	taskkill.exe
904	taskkill.exe
1364	taskkill.exe
2296	taskkill.exe
5152	taskkill.exe
2352	taskkill.exe
6028	taskkill.exe
1776	taskkill.exe
4316	taskkill.exe
5820	taskkill.exe
5124	taskkill.exe
4856	taskkill.exe
5456	taskkill.exe
5696	taskkill.exe
6140	taskkill.exe
2284	taskkill.exe
4464	taskkill.exe
2256	taskkill.exe
1112	taskkill.exe
5492	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
116	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3396	regedit.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
800	WINWORD.EXE
800	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
736	chrome.exe
736	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeDebugPrivilege	600	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	780	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	996	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	4316	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	4464	taskkill.exe
Token: SeDebugPrivilege	112	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1364	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	600	taskkill.exe
Token: SeDebugPrivilege	3912	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	4612	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	4904	taskkill.exe
Token: SeDebugPrivilege	4316	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	1848	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeDebugPrivilege	1112	taskkill.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeDebugPrivilege	5152	taskkill.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeShutdownPrivilege	736	chrome.exe
Token: SeCreatePagefilePrivilege	736	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe
736	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1560	java.exe
4524	java.exe
876	java.exe
4704	javaw.exe
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE
1764	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4524	1560	java.exe	90
PID 1560 wrote to memory of 4836	1560	java.exe	93
PID 4836 wrote to memory of 4984	4836	cmd.exe	95
PID 4524 wrote to memory of 1652	4524	java.exe	96
PID 1652 wrote to memory of 5028	1652	cmd.exe	98
PID 1560 wrote to memory of 1160	1560	java.exe	99
PID 1160 wrote to memory of 4504	1160	cmd.exe	101
PID 4524 wrote to memory of 4288	4524	java.exe	102
PID 1560 wrote to memory of 3916	1560	java.exe	104
PID 4288 wrote to memory of 964	4288	cmd.exe	105
PID 4524 wrote to memory of 4916	4524	java.exe	107
PID 1560 wrote to memory of 1316	1560	java.exe	113
PID 1560 wrote to memory of 116	1560	java.exe	118
PID 1560 wrote to memory of 3348	1560	java.exe	119
PID 1560 wrote to memory of 4856	1560	java.exe	120
PID 1560 wrote to memory of 4704	1560	java.exe	122
PID 4704 wrote to memory of 876	4704	javaw.exe	126
PID 876 wrote to memory of 5044	876	java.exe	129
PID 4704 wrote to memory of 2616	4704	javaw.exe	132
PID 5044 wrote to memory of 2352	5044	cmd.exe	133
PID 2616 wrote to memory of 980	2616	cmd.exe	135
PID 876 wrote to memory of 1616	876	java.exe	136
PID 4704 wrote to memory of 4188	4704	javaw.exe	138
PID 1616 wrote to memory of 5104	1616	cmd.exe	140
PID 4188 wrote to memory of 3972	4188	cmd.exe	141
PID 4704 wrote to memory of 1836	4704	javaw.exe	142
PID 876 wrote to memory of 1500	876	java.exe	144
PID 4704 wrote to memory of 2092	4704	javaw.exe	146
PID 4704 wrote to memory of 5092	4704	javaw.exe	147
PID 5092 wrote to memory of 3396	5092	cmd.exe	150
PID 4704 wrote to memory of 3172	4704	javaw.exe	152
PID 4704 wrote to memory of 600	4704	javaw.exe	154
PID 4704 wrote to memory of 1776	4704	javaw.exe	156
PID 4704 wrote to memory of 780	4704	javaw.exe	158
PID 4704 wrote to memory of 3728	4704	javaw.exe	161
PID 4704 wrote to memory of 2428	4704	javaw.exe	163
PID 4704 wrote to memory of 996	4704	javaw.exe	165
PID 4704 wrote to memory of 3048	4704	javaw.exe	167
PID 4704 wrote to memory of 2972	4704	javaw.exe	169
PID 4704 wrote to memory of 4316	4704	javaw.exe	171
PID 4704 wrote to memory of 1960	4704	javaw.exe	173
PID 4704 wrote to memory of 3788	4704	javaw.exe	175
PID 4704 wrote to memory of 904	4704	javaw.exe	177
PID 4704 wrote to memory of 736	4704	javaw.exe	179
PID 4704 wrote to memory of 4464	4704	javaw.exe	182
PID 4704 wrote to memory of 112	4704	javaw.exe	184
PID 4704 wrote to memory of 2256	4704	javaw.exe	186
PID 4704 wrote to memory of 1716	4704	javaw.exe	188
PID 4704 wrote to memory of 1364	4704	javaw.exe	191
PID 4704 wrote to memory of 2024	4704	javaw.exe	193
PID 4704 wrote to memory of 1472	4704	javaw.exe	197
PID 4704 wrote to memory of 2432	4704	javaw.exe	199
PID 4704 wrote to memory of 600	4704	javaw.exe	203
PID 4704 wrote to memory of 3912	4704	javaw.exe	205
PID 4704 wrote to memory of 1852	4704	javaw.exe	207
PID 4704 wrote to memory of 4612	4704	javaw.exe	209
PID 4704 wrote to memory of 4384	4704	javaw.exe	211
PID 4704 wrote to memory of 2972	4704	javaw.exe	213
PID 4704 wrote to memory of 4856	4704	javaw.exe	215
PID 4704 wrote to memory of 2296	4704	javaw.exe	217
PID 4704 wrote to memory of 5000	4704	javaw.exe	219
PID 4704 wrote to memory of 1504	4704	javaw.exe	222
PID 4704 wrote to memory of 4300	4704	javaw.exe	225
PID 4704 wrote to memory of 4128	4704	javaw.exe	227

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3348	attrib.exe
4856	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe.jar
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.40621760402719731645158742081593760.class
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive544272784856690749.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive544272784856690749.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:5028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6126740013099227201.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6126740013099227201.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:964
- - C:\Windows\SYSTEM32\xcopy.exe
    xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
    3⤵
    PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3151762074368179828.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3151762074368179828.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:4984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7343482986547487562.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7343482986547487562.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:4504
- C:\Windows\SYSTEM32\xcopy.exe
  xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
  2⤵
  PID:3916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1316
- C:\Windows\SYSTEM32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NYRZDOmEJZd /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:116
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\xmpCzqQrOmL\*.*"
  2⤵
  - Views/modifies file attributes
  PID:3348
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\xmpCzqQrOmL"
  2⤵
  - Views/modifies file attributes
  PID:4856
- C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
  C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
    C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.0155148427001993166104026047986646318.class
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3962589943039650348.vbs
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3962589943039650348.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:2352
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3457426627432773044.vbs
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3457426627432773044.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:5104
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:1500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1947575071698440058.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1947575071698440058.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:980
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4387596353394279747.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4387596353394279747.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:3972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:1836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM UserAccountControlSettings.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\TUYUjIpGmT2237695437826536015.reg
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\TUYUjIpGmT2237695437826536015.reg
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Runs .reg file with regedit
      PID:3396
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Taskmgr.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ProcessHacker.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM procexp.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MSASCui.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MsMpEng.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MpUXSrv.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MpCmdRun.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM NisSrv.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ConfigSecurityPolicy.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM procexp.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM wireshark.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM tshark.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM text2pcap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM rawshark.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:736
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mergecap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM editcap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM dumpcap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM capinfos.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbam.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbamscheduler.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbamservice.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareService.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM WebCompanion.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareDesktop.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Main.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Svc.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Up.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3SP.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Proxy.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Medic.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BgScan.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuard.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuardBhvScanner.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuarScanner.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM LittleHook.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuardUpdate.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM clamscan.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ClamTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ClamWin.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cis.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CisTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cmdagent.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cavwp.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM dragon_updater.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MWAGENT.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MWASER.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CONSCTLX.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM avpmapp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM econceal.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM escanmon.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM escanpro.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM TRAYSSER.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:5820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM TRAYICOS.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:5964
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM econser.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM VIEWTCP.EXE /T /F
    3⤵
    PID:3928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSHDLL64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fsgk32.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5332
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fshoster32.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5492
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSMA32.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:4832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fsorsp.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5740
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fssm32.exe /T /F
    3⤵
    PID:6080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSM32.EXE /T /F
    3⤵
    PID:4576
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM trigger.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5204
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FProtTray.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FPWin.exe /T /F
    3⤵
    PID:5776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FPAVServer.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5824
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVK.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GdBgInx64.exe /T /F
    3⤵
    PID:3728
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKProxy.exe /T /F
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKWCtlx64.exe /T /F
    3⤵
    PID:5780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKService.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKTray.exe /T /F
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDKBFltExe32.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6140
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDSC.exe /T /F
    3⤵
    PID:5148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM virusutilities.exe /T /F
    3⤵
    PID:3240
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM guardxservice.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5136
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM guardxkickoff_x64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM iptray.exe /T /F
    3⤵
    PID:5288
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM freshclam.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3132
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM freshclamwrap.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:884
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7RTScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7FWSrvc.exe /T /F
    3⤵
    PID:5704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7PSSrvc.exe /T /F
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7EmlPxy.EXE /T /F
    3⤵
    PID:5032
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSecurity.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7AVScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7CrvSvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7SysMon.Exe /T /F
    3⤵
    PID:3068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMain.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMngr.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nanosvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6028
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nanoav.exe /T /F
    3⤵
    PID:5720
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nnf.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvcsvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6120
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nbrowser.exe /T /F
    3⤵
    PID:1808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nseupdatesvc.exe /T /F
    3⤵
    PID:5128
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nfservice.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nwscmon.exe /T /F
    3⤵
    PID:5020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM njeeves2.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4464
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvcod.exe /T /F
    3⤵
    PID:1472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvoy.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5276
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM zlhh.exe /T /F
    3⤵
    PID:4344
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Zlh.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5644
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nprosec.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Zanda.exe /T /F
    3⤵
    PID:3972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM NS.exe /T /F
    3⤵
    PID:1848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM acs.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM op_mon.exe /T /F
    3⤵
    PID:5216
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSANHost.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:560
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSUAMain.exe /T /F
    3⤵
    PID:2352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSUAService.exe /T /F
    3⤵
    PID:5692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AgentSvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BDSSVC.EXE /T /F
    3⤵
    PID:1928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM EMLPROXY.EXE /T /F
    3⤵
    PID:4492
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM OPSSVC.EXE /T /F
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ONLINENT.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:116
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM QUHLPSVC.EXE /T /F
    3⤵
    PID:4332
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SAPISSVC.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:5124
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SCANNER.EXE /T /F
    3⤵
    PID:5164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SCANWSCS.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:5588
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM scproxysrv.exe /T /F
    3⤵
    PID:1764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ScSecSvc.exe /T /F
    3⤵
    PID:5400
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SUPERAntiSpyware.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5864
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SASCore64.exe /T /F
    3⤵
    PID:5876
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SSUpdate64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SUPERDelete.exe /T /F
    3⤵
    PID:5612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SASTask.exe /T /F
    3⤵
    PID:1012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7RTScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7FWSrvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7PSSrvc.exe /T /F
    3⤵
    PID:748
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7EmlPxy.EXE /T /F
    3⤵
    PID:3376

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ImportSearch.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:800

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DisconnectGroup.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcc115c728,0x7ffcc115c734,0x7ffcc115c740
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,1320086716473712722,6375398507182934809,262144 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,7032754068404638886,11183418900327257298,524288 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,2998917170577213440,8152668990499967622,524288 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,17094742923277422566,483127236613820134,2097152 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,891010591257691604,13917153880970475653,2097152 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,5367729747645145413,16985994938221702642,2097152 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,4877008984849079297,11762905226683407765,2097152 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,2933298903603445010,3813114187838786886,524288 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,15776904058597558156,8042134133428730118,2097152 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,6402544744729039512,1699251442486415824,524288 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3404,i,10100626589779139493,17365785547562150406,2097152 --field-trial-handle=2004,i,14458113994825615472,7904798221683926489,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b6a96a48d0e32eabfa5bc98a7cf8f8bf419621ef748758bcff159d21dac0e6fd
MD5 b7304347de91f29028710ea27cb57a93
SHA1 09bb3755c20e9bff333711b4d24274bcd6e70848
SHA512 69fc595a7ac5e44225b07e0e54aad46ebd0742f180a4031e5044da56afe83a3ed51797807368378a8b9ad8c78fd04253b957846c750415ce6f12ab6026acb6eb
MD5 SHA1 SHA512

Submit Download

50569f7db71fa7f8.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp
Size 54B
SHA256 f36a20fe18a10529ce0d2ee55f292191e5edd0caa055f3023eb304e30d795a15
MD5 cdee409f9054bf4429b936795694773a
SHA1 4a2ebeaa104440a0540367ef580dd2425acffd38
SHA512 198bcf7551380870683ebf2f642fe6f6bc6c3c20409fae1429249a64c2f760b71e22ad2f5a1d23b609c51c1d325cfb17edcc8386eb9c31269d2be5b7ca796fcf
TLSH
T14090025401D8AE2B540540575677604CC5654B407B95391C8B54C88CD540514E582042
MD5 SHA1 SHA512 TLSH

Submit Download

08deb3d1-2511-4068-b53e-73ccc3edbc86.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\08deb3d1-2511-4068-b53e-73ccc3edbc86.tmp
Size 266KB
SHA256 9631ee24374546780933c4297a22ebe2933bd27c26bb2d6880fd702033a231d8
MD5 8cc22f8318aeb0dccd83aae00b365f15
SHA1 3ff00494cdc5be7ba5388b6b5601b901bf60f239
SHA512 7d9836657b606c9f624450be5b3c23ac7843442b1fb1e6acd9851778ba5323dacd123fb4a9be50ca91a49f3683e4e6803eb74add0265293084f875efaf623f2f
SSDEEP 6144:3+UZtACh2HfU+f8LDaJCj/kA64ei8PaN+hFD+7t56OD9ZfSApprJ:btACh2HvkvcA64eFaNyFSXD9ZfS4f
TLSH
T12B4422B2EAC4CC27D8BF5D15B12793208EF22CE944E62A0C44994FD765ABD9D0B53C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

294cd03c-c777-44d9-a430-fec8b907955e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\294cd03c-c777-44d9-a430-fec8b907955e.tmp
Size 130KB
SHA256 75afde03d2726ef792ce6b3aeb42ae41acdf8b1a0766b228b71b917aae1e5071
MD5 68dcc5e1d541eb4eaaf4181b644c5b84
SHA1 ed0f8507db42921da74ba6064341dbef693153af
SHA512 2ba0bd5927dbef2d72068666255b876d99d100b48a95a9e2773dd02f900ffd4efa97a74b0f904b11279963759c81d31e8a55a467fe16f7abf9a45d0f4818f2e1
SSDEEP 3072:wJE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wC+hFD+7t56OD9ZfSAppr3
TLSH
T1C1D31232AA94C8BBC9BD6541F157A300CE626CED45DE7A09444A9F8EE09FC5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ecc2b7e-fa9b-4eac-adf7-9878efa0e9ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6ecc2b7e-fa9b-4eac-adf7-9878efa0e9ce.tmp
Size 266KB
SHA256 d7c005266526dae3263f2cb27ed07a0a0462f42072e97ffdb05c4ebe1c0ccbaa
MD5 04c1838a88f7a192d90002e400b84cb3
SHA1 e8101e4ff4363bcede6115be12bf2d4408ac6a28
SHA512 a4340953de06868acd394c11c10f22a41d65df99bf5f077f65e7860bc35e511a43f1adcf7831a9ab483ef3f82f97ea8aa8a4d7c74c6e8fc60753a673412a82ea
SSDEEP 6144:3iUZtACh2HfU+f8LDaJCj/kA64ei8PaN+hFD+7t56OD9ZfSApprJ:3tACh2HvkvcA64eFaNyFSXD9ZfS4f
TLSH
T1B2442272EAC4CC27D8AF5C15B12793208EF22CE944E52A0C44994FD765ABD9D0B53C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6425e306544eada3397086f82b6fd7cdb8aefeec7d1cb40f10889682c6dcdca2
MD5 f4047e2d9124e64dc7905462238d66a7
SHA1 d0d02389d27ee899b8ab1f357d020446eac137f9
SHA512 8ef4320644acd749609a792ccff20a44ffcce07d2ce7e1172a15bf59d701185e22fe861ae045f73a0f84239b8439a16c38b164dd017a3bd0debd8431bf9b860a
MD5 SHA1 SHA512

Submit Download

22f14957-cb73-4c23-b604-9e5bfa2e49a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22f14957-cb73-4c23-b604-9e5bfa2e49a3.tmp
Size 12KB
SHA256 2d03948d87234f6add1ac4c37e1f0d9e4a7c86703facca22d60f67fc15a868dc
MD5 530521bf0567e2df8e36bac1077bb81f
SHA1 03c3d7adc5447d7cdbb744e4761554e0d6f399cf
SHA512 1eb2c3f3bd5ce63d77f7b6738cb2fa6bfbd6c375edfd2b218ea451e81c01bce898c8b347241974ee6e2635b26f42d3967b406cfdae68be0a1786589bca059f6e
SSDEEP 192:rRAcBz9FqvR7zaLv7VJpAPRp2iez9fHsb+WNnSg4UK2cQr2zesc36VyIsnAUgtaJ:rRAmzPYQzvUX8hwhW2ci2YK8
TLSH
T11442A22EE920797B5CDBD31AF966B766E7F9102121842E84EAFCC93C21D79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7619dc83-ff85-4443-8725-60dbaf6cb832.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7619dc83-ff85-4443-8725-60dbaf6cb832.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 66KB
SHA256 61ce9a9b62fb5b73f80e511dc69d636dc3b1bc5931b4332c7adda82c67302091
MD5 4a7c751b21f615bbae51ef520abf06c4
SHA1 6f72ffcc56157f7803d15b79144a0dd4d494fc99
SHA512 be463084fabf72d452e011f80858f5ccd2a70e5a35c751f8762b9eb065da2d4b9c82fab870641c8dcc160199280ed925eff6b97b6b861825fb3b69c1ff7a0f24
SSDEEP 1536:zRh2EtzJAvN4DDC9pBqD9+2yJJLiBvfZJtUl0L1cKrIBrHrf:zfrzJAvN4vpDTEivhJtr1rI9Hrf
TLSH
T1B16312C8A9B267DB67132B447473044BD85F5B749FCC22B13A8F761108E0DEA8AB0E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 96f702a9cce1b1eb0ef3d47c3fcc52dd8f0e7fd53d5875693aef9a84220e465e
MD5 d1add5c12f14050c523d56efc2da0307
SHA1 01c76c207315872c1fd59142657bc1df6cd54480
SHA512 05228ab2782ca8e26c89360a08d009ff47c2b09c3160e84565341408473b35e5cea908b2c878fefdf699bca54a90817ea9afad6d0e128806086f7235e44d29cd
TLSH
T1112155DE2262515CDFEC3E731AE696303A00B37F98130A291F88F8057F97270035AA8D
MD5 SHA1 SHA512 TLSH

Submit Download

4a7fa7d6-b8a4-4fb4-91b5-521d577e4837.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4a7fa7d6-b8a4-4fb4-91b5-521d577e4837.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9e876967-fa31-4b00-bf0a-9ca18965df05.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9e876967-fa31-4b00-bf0a-9ca18965df05.tmp
Size 6KB
SHA256 0b33ecc9c1e79d6af9d1b01eaffe9ffa43a9b377b758b9d4296d48bba679b7d5
MD5 f11029ebd52804d9e7d17601278e5a86
SHA1 19158244af0ed5c0a0fadb7567fd383e7725ac01
SHA512 c1b13428b63448d354a33fc482325ca2187dadf4279615e0e1d9f24035bb3882a5958e70805ad67a6c96b3c047e15bc34db1257c24e5782191adf0d7784fb80c
SSDEEP 192:DAqCTKIXkLBN2Sgu5u4HU7Y+tsaPqv03KIl6fPOFNPl:DAqCTKIXkLBN2Sgu5u4HU7Y+tsaSc3KY
TLSH
T100E17EF7C3D8C62DC85556F49B256F2ECE290A18421C3C26C8D8AE5F93E2871D39175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de2f9023-8cf2-4329-8a28-c222ded2bfb3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\de2f9023-8cf2-4329-8a28-c222ded2bfb3.tmp
Size 523B
SHA256 cd8a51e6aca7fb3415f568b84377dd7ed82cedecd21a7fd5703e490f40f92989
MD5 cda8bab71b4d779063d066345f4b5d6e
SHA1 91f155e3da336fcd8f625ecf331df83d85f64883
SHA512 4114fe1099b5b124eb73c93215b8ee69fb260c2108bee6ebf3bfb2b4315e5d87a4ff0454b90fd558ec70438c7ca7dfceba5f550ecd51a383bdc17c285345a547
TLSH
T1DEF059A7A6BD7433527E45EB1E017C0969FDA4321281A8E0CF5B426CF0D14F75B12013
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 95718640c3bf24dbd48e2aef133e1607230811538dfbf7ab38ab3078958716c1
MD5 3e39538eb95ba8603b5b6e13c31f059e
SHA1 b341633cecbca212884a4c6ec65eecd86a56d867
SHA512 909906033624f736fddd38944e48c0bbc24afd3b2d8985de7bbf31d62b983a58bb0cc61284518a89cce7b9819fcdfc3a6e0d8fa46906757df83c251f84ae12d4
TLSH
T1C2B01294C0416301C15202F426A034883154DF15A605170183F01E01DC39561801F054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 182a90ccd5c0968be5fac67b431e8f7fecf7539a51140685dec042ba9cfd3ae6
MD5 7aa9be2ca810de788ee368e657db4288
SHA1 0ebd5516ab7eba250c171d988ca68636d545da0f
SHA512 dc772c65e2ae0866be78812a9cd6f236a8fda0efacd20bbb1b3fe9ee8003423f9eb7f1953ec0787e70082ce9793f8c97b8c38e169d7acbf4d390dd6fcdcffc39
TLSH
T172B02280C0032302C08203F0288088CC3830CF22C30302028BE02AB2EC202A000300A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 190c4335e9901907e6b059fd6eb9b335260de90d298b90a5e32852bb9657fefc
MD5 6a590ccd8c6701368973be509c526f51
SHA1 b706ea7434fb4eb123a09798a9815d0e7241a522
SHA512 be2d912086dfddd7817315b0994d98003f003576745cf72042b3310f148010284fe20c3d3bdbc442c4500da50702e8b818a289f4a0fa51fe821073da82266442
TLSH
T118A002D923546300CE5D81B8D64121D4D3016E3522125A0345D41556E99414B9145654
MD5 SHA1 SHA512 TLSH

Submit Download

e4132eef-8fd0-46e7-9d78-4655177491ae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e4132eef-8fd0-46e7-9d78-4655177491ae.tmp
Size 649B
SHA256 455e20bd5aed7a784e943eb267d43fe862a79097510d1e8db49dc8e8f47084e2
MD5 b4d27cddeded4502ed9bf4170e762895
SHA1 cfc551a5f41119065733f38f6b15a2eeb70c8b91
SHA512 1527aa0b1c2218d25215662a174b287740fab5068d358cd08368501d94a8f8e51df897eef63db66bc65b7506b620848ff58ec6ffeb934cecb953d3be8e2862f7
TLSH
T1F4F02DB9CD21BC371CFC1B2D60A41B4BE75113672B51854B773D820C8FB467B464591C
MD5 SHA1 SHA512 TLSH

Submit Download

e8d04381-82d8-4449-a9b3-15f35b8ed411.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e8d04381-82d8-4449-a9b3-15f35b8ed411.tmp
Size 13KB
SHA256 99627e6a442d1edb64322155ca280bd908482ee3374ca1fd77ff2e145b6bd9d5
MD5 f6dfb7eb04edec0cf1beb813f827f069
SHA1 90a0a4b16e3cae2728e51d37e32bd54e6934e2d9
SHA512 ff30aef2b0e7b273388328b5e7dd5576b47999eef9e5ebf63c99faac55ea30cdcdedb0b259777693de2c64e1b8d5d95e6417e7cf858d4dc865cd41a53a8b55c4
SSDEEP 192:rRAcBh9FqvR7zaLv7VJpAPRp2i/Y9fHsb+WNvYSg44eecBr2zesc3IPyIsnAUgtK:rRAmhPYQzvUXQhweqecx2Yi8
TLSH
T1CB52A32EED20697B5CDBC31AF966B7A6D7F9102225842E84EAFCC93C11D79CD2207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc41285a-8d3d-4e8f-9776-b787daaf6ec2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc41285a-8d3d-4e8f-9776-b787daaf6ec2.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Word.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Word.SurveyHistoryStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

Retrive3151762074368179828.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive3151762074368179828.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
TLSH
T12ED02B0094E3C35000BE970290E9662EF9A2020D32015B487D4450F3222E0BEEAB15B5
MD5 SHA1 SHA512 TLSH

Submit Download

Retrive7343482986547487562.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive7343482986547487562.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
TLSH
T1C0D02B00D4E7C39000BED702D1E5926EB9E2010D320157487D8490FB12AA07EE5711B5
MD5 SHA1 SHA512 TLSH

Submit Download

_0.40621760402719731645158742081593760.class

Path C:\Users\Admin\AppData\Local\Temp\_0.40621760402719731645158742081593760.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
TLSH
T1E634F10DFBAD84A5DBE6203042D644C6A7752E94E3C184738DB6726343B5E73DA23AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_46640745-cc7c-441b-a342-5006756a8d68

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1696934516-3600988056-1840298893-1000\83aa4cc77f591dfc2374580bbd95f6ba_46640745-cc7c-441b-a342-5006756a8d68
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 321B
SHA256 bafbda3460d91ce19050d10283279a88e98f6353780b9e617aaee15827e363ad
MD5 172171c316f025b8502d293b7421ef2a
SHA1 71ffa23ffcc0bd5366883974114cb3c894308165
SHA512 ccf1150c8dedd903a4e9058ad7e98221e61a50f55fb5e0a1d6ac6917ab8c70b4a743f1e511b91d620c6c89ac97ed6d80708b80511c5723b6fd3a63d856699178
TLSH
T11CE086071BA8DBF1837E919436B6ACF14EF38C4CD795103005CC1DE64D9098321D7981
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 321B
SHA256 072ba3cb72e19cff4f0848178f4a1701c2a731b5a44433d84bc6d7ad943662e5
MD5 1a9f22e1f5f17efe1b851b996e6b174b
SHA1 7e98c9798aab4176775ef7957e43dc2148af5755
SHA512 71bdeeb3121b7b8fb050a0ccd9c16c062eb2706c26d4b64aa66c36e8c7174f3a9254b31d3ea36e1cf33be5a0a868c6a8cd2e9db8e27b323696fe5ad71bc22ee4
TLSH
T1F9E086071BA8DBF1837E919436B6ACF14EF38C4CD795103005CC1DE64D9098321D7981
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
Size 1.3MB
SHA256 6d1c82cad959b7e4636d8fced4368f0f2c8da4ef609667396e8772ad8d63f736
MD5 39a3de251306cbca47cf2fb10089ae9f
SHA1 cc3f3d1bc3ad172c9646961b18fe1d7bf98b59a5
SHA512 351a02453659d04a2943abc1da2b9541f97982ed3f94d288679dfd8d962bfb4b0dcdef9b06d329bdad64e032b0372733ff7d1577c49952accf86b971aed86f7e
SSDEEP 24576:or19iF8DpwAZGFCFcbtv5nHSaELVPwtDi6MDO6aBN1VWgerlE6:6XiF8tpGFJHwVoY6MDO6aBN1cLf
TLSH
T1BB658D07F3944095D66FA4B4C29B521FE7B2B419030097EB32B19B6EBF67BE06239345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Size 162KB
SHA256 179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54
MD5 4e6dfd5867f4cea96dad1d59a0ca43fe
SHA1 6a08abc0b5a2cab00eb6d7543c661aa6620890a1
SHA512 2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b
SSDEEP 3072:dgpGH1/rHpcDJ0oL9JLVZcRysrS7DgWw2xM:Wpg0TZHQh
TLSH
T170F32947A3524092F457B6B8B12A000BF376B465032C92EB43E58BAE5FAF7317D47794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
Size 285KB
SHA256 af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e
MD5 dafb5fbb0614c19eccdab9bef8f89c22
SHA1 91ab91eb4a90f02c4950c3e5da80f3eb24bddb52
SHA512 81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93
SSDEEP 3072:5LBM1lpzb9ydKHsz1//3H+ktNNWo7vNnParlMhubG0XqkwnJEszNvarvcLPYDJ67:pWPZw225bN5zFEjGkqkAJHyEzYV/PvyX
TLSH
T17B549E95B3901CF8EC67813EC9558906D6B27C5A0B70C65F03A436675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Size 285KB
SHA256 a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef
MD5 7fb44c5bca4226d8aab7398e836807a2
SHA1 47128e4f8afabfde5037ed0fcaba8752c528ff52
SHA512 f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab
SSDEEP 6144:PAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:PCd9/WYoaLHF3z0z04PDvhD
TLSH
T142548EA5B3901CF8EC67813EC9558906D6B27C5A0770C65F03A836675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
Size 104KB
SHA256 833cdbd7b221dda58ba728ee9a41cac1d6819d19bfc7336a4b86cc69a5af3695
MD5 6c720917e5c8ce1202a4141e8c8cfaf7
SHA1 1175d918134983d1d64a42047f4ff814054123de
SHA512 217f824b389547993556c26069d58eb956e87029b5c58556c2d308e48a0db2a02a057b3147fcf6ac7606f2b97ada33e2372112e93944f645137d81cc0dd32a9d
SSDEEP 1536:2vpp3y2kIlAYVZ+qbzKWrTcJuV618k89DmucOiG/OJY9GzNAiKyy0CLLLdx7PPxD:pYSqbzKWrTcJuGbEDmYGeifLCDdxLxD
TLSH
T1FCA35A05736824C1FC3BD2BC8586461BD7B3B4B06260939F13A6C65A6FDB7B13E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
Size 66KB
SHA256 686021b000cd6d76b97c6f924c528293bc55dfb4ce936cfe70959eecd1665c90
MD5 d8a6b5e5a33cb71b61964be369526704
SHA1 7788adf9163fb2ac2c85c43630c0998b0f13360a
SHA512 d15e5832d025a8fb17dd48b8c6d8246b93d54543ba52d40a9f97aff257847f7e05971ae927a77e12ab1625dc514a29115ce5fe9ddad18fe5fc4b0ddc2f8ca6d1
SSDEEP 768:QSwbGTKTjBFs3zdaON+ClYKaFwoqgzizndNXur2Z3/oHbg6wuZWm3w3hUjhgYi5x:olONFYKAQn7Xur20bCCJ3Khyhg75PxQ+
TLSH
T154631AB253A4489BE42AB53C429A075BF433FC508510A39F532987169B6F3B33B7D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
TLSH
T1FCC40927B74D02A0E195A3B861C34305D7F1BC4A8312A3C752FAD66E2F6B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
TLSH
T174936C4677A542B7D06AD278C2E35A06F770B844877063CF03B64AA94F23BE19E3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
TLSH
T16EF24B9467B88446D06B86B0C4D3AE57BE3CF9655750938F0BA4C29D1F23BD0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 8.5MB
SHA256 6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21
MD5 dceeb4fb6af9bb2ea7a2eed1d921afb5
SHA1 af1463a499f7d6eed5efcb9c9515e82335e9c1b6
SHA512 e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763
SSDEEP 98304:OhNdNu6fLpeSRNeOhWnaC5Qu5e9kmhRVfvLP0KsH1OIueGeM1Q:OhNdNu6fLpDRwOhoaCyucC0RVfjPiHuC
TLSH
T11D966C5A927050D8DB2AC2788B17DE47E7F2F4A40770ABCB11B8434E5F17BE1297E216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
Size 142KB
SHA256 86106645d9e3801911808d6343a7fead7b6e9d8b740bad63a4cd9851ff599283
MD5 2632b6d90868ff1ece67f76b86a23d79
SHA1 90ddedde02a4cc37ae361caabc36a6a686c24bd1
SHA512 61e0581c3dde45db74383b93e56396c65435714e746fe4f000c53465e8e6750bd787b5895a987bbdbe4badb5ad3570394c82476c2b4d65099f0b923002153b18
SSDEEP 3072:2zs5pH2Lmngo9QVKTIVbheI14/QwIwS6ycf+lxhC:Cs5pWLmngo9HTMhp14Hpyc7
TLSH
T1C5E36C4732E08297C9638A31C953F55AEFB0B82576E0C37B13574A45EF23395AE2B325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Size 55KB
SHA256 9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb
MD5 82bb3a2292372acbf8bb25e30a3e169c
SHA1 c09c134561213cd67c670f60a2c52cf947e51a74
SHA512 db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7
SSDEEP 768:gGq5ZtjA9EC+mzTJaJSMR26WPI/hY5iX2N9mWKYilefjPxWEta:gGsTSP+mG726iI/hqPN9mWK7wjPxG
TLSH
T1AE436B6792A00875E087C538C5639EDBEBB1FAD51A4083CB4360C6CDBF53B51EA2477A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Size 87KB
SHA256 27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9
MD5 0d56a7ff632826362768b3edd5e5174f
SHA1 8b96856f8fe3175039d1a7cf3ac0910467844a08
SHA512 b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595
SSDEEP 1536:d4oESIZDpOoUQ4Ps5OwVOIOQIO6nqejL8j672PxV/:d4o5IZDZUXwV8G6nqejLY6WxV/
TLSH
T1A5939D918A605561DAB799B0C9F68A2ED376B02013C497CB534CC7962F477A13F8C3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties
Size 149B
SHA256 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
MD5 2ed483df31645d3d00c625c00c1e5a14
SHA1 27c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA512 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da
TLSH
T174C02B03F08E17B95C0C18FB01DCD4C0B38049CFC029530F54E6213A6781C38008846F
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
Size 634B
SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
MD5 499f2a4e0a25a41c1ff80df2d073e4fd
SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
TLSH
T152F00CAB8009672653A221E77680385CEB52D13CE22BBCFA1148AE883D03CBCA017856
MD5 SHA1 SHA512 TLSH

Submit Download

charsets.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar
Size 2.9MB
SHA256 04a6bc7af4d41fda5ca6c7584df50c5d0881fada89b4788e8ee4e5919345f143
MD5 bfdb22624544f02100cd37cff954f64c
SHA1 f699b290845f487cb7050d41a83b85446ea202b1
SHA512 70c5f501c5e1cc67341bb3f4d190179a79fb8bee7292ff8cca0749368ae4475387ce121e8d33adc7e4e6fad5a10eab378fff17e3da0422d4cca0837c95574b95
SSDEEP 49152:WmiR2z1nkI+mstfIrIUj0z8zRnvvyllbIWLrm:WmiMzNwxN+5n32lbI/
TLSH
T15AE5AFD344451EAFD60B92BF1B60ED0B770E78A61907B240FDB94C19EA5C62F68D2F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages_zh_TW.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
TLSH
T1217154FE0A1622472ECA80E1D985A58FD7A2FE01B122C52BF5FD6D01775731BC913A38
MD5 SHA1 SHA512 TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index
Size 1KB
SHA256 f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8
MD5 005faac2118450bfcd46ae414da5f0e5
SHA1 9f5c887e0505e1bb06bd1fc7975a3219709d061d
SHA512 8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9
TLSH
T114316B1B458BA16EBE2E0ECABF37EB81665CC23B041951BC04C90C85A50DD0E2F38D75
MD5 SHA1 SHA512 TLSH

Submit Download

sunec.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar
Size 46KB
SHA256 cfe84c5292f9ddef96fecf118377565bbaf769eee7ff4cca81652fe1134f9809
MD5 1227482c65dc231e3607b002950f5497
SHA1 709ff3738d5da8db225818df2966f04c13cb7d02
SHA512 87c4f5fa1e6dad6f2fab8a0371380fa7be9f63b05f8ff6740a4208ec115f8db9c512de9e40b4b853be35effed2804d0774c0e9426571a129cb6bdecd527cdb8c
SSDEEP 768:4731B13B5aguVlb2TUVMbLjwP7l6lxiHsWhoc2toqMmrV3lkwhEafSkjmPX+M6ij:2/7ggIYU6GlQ0Hnhoc2mvA3ewSafSZPd
TLSH
T1A323D04FA9B5507EE14351B7D012D1BB2B2C95C694C7C2BA0D91452BF828D7B073A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunjce_provider.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
Size 287KB
SHA256 324499cedd3f19ea621a38f42834369d7da8bdf40fcb5a345007bfa2e5987780
MD5 456031723ebc7270d9bc3747cdd6daa2
SHA1 a4a61bb10ac83f201854a11750aa86e7dc8da41b
SHA512 b425eabd590f905aa147720aa507a0da2b31199956f21137a722fe6c8de05549d1cddbb2fb2ea1cbe34e39ce9d0eabb0502dd2a9a09f72dd87cd002765537079
SSDEEP 6144:5lQ8GTsacebwePne9NuAZ9ObVT/slrNoCawdxpFfGi8+jBuTW:5bAPce0l9NuAZwlsl1dP86B0W
TLSH
T17854BF27ADADE838CA8B85F57471CA15FA0958F4B00BB27E03D20973B8A5D471B117ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32_CopyNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

jce.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
Size 119KB
SHA256 4362c179bb78107777d6a0557693e65eb2b318c26642162f89509dfdab8c97fe
MD5 e0b7e0f36b9fc43d13403145db82e758
SHA1 def42078cfa315e98393c69963efb4e35e2e28a8
SHA512 5074a7ceb9621096f3bbf419d32ac260ea6d9d09c758544c2761121026c2b9db0b6617806d3b692347b685d541123f4eda99dcbaa29d9c9a2d740b22c44bf7bb
SSDEEP 3072:p+uhK+XLGLuDfH3HiMAHElMueD+UgUBvVE:/f6Y3HiLvJ+Uju
TLSH
T145C3E029BEA8EA25FE53C03E9870D833B81E46C9970B8387879584E860F4DD45F12FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar
Size 560KB
SHA256 bded3bbadd255c856ed7fb9900cbf0445e980a669a3aa043cf095e18539eb48f
MD5 530b1ee313390d5d51ae8f5aa0be9070
SHA1 d5de5ee8bd7275b5b20f466ba0869251679b24b3
SHA512 50671ca7de240c38921849304ae482a52ae481d0ff5a2f02aef90c20b9f49842bf2ea32b9caabde57a955b8d638a017b6b3cdd662b679a2d743e029f97b88937
SSDEEP 12288:D5l+qU67FYWg+YWgYWeoXqgYSqYQh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5cG:D5l+qU67FYWg+YWgYWeoXqgYSqYQh2fC
TLSH
T1A1C4D70BF19A25EFF280F73F29908F6422F0D472022BE6618F559D5A1DDB8D7EA406C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
Size 1.7MB
SHA256 fffafe7e2bacef79280a4565b5d1075320a8ec38dff7978c8fe6c033b6df49d0
MD5 01408480f5c65da8c74ecfde0eed1a72
SHA1 2f1cb5df6d4879de8b0827d160e9bb281f829a3a
SHA512 ae585f4825073da19f611bb7d11a1d075b4998bc3f7d53a67cdba778e0729e0b5134ce8fc49897f67d39e46f1209524ab53ab4551defc6a4127012e332f15d61
SSDEEP 12288:HjlqLkoqdD4YH+b8RseFxOs/Mf8AMBIbvTHegwbC3:HjlnPHq8R7FX/SoBs1
TLSH
T1F1858217E10C98BFF244DAFFED70022837346C365C63B3784A49495AF1DA6B14A78AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
Size 2KB
SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
MD5 91aa6ea7320140f30379f758d626e59d
SHA1 3be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA512 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb
TLSH
T10741566F0287842F9E980DCBB577DB964BA8843618D8A3FC43E41C4576CDC4B0734A74
MD5 SHA1 SHA512 TLSH

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
Size 3.4MB
SHA256 65a6d0d74b193af857dd5252d59e8bf9214ddb360b26c1da816b029bf0cf208c
MD5 c5152884c2676dd45109cfeba088a549
SHA1 8fe4fd1980bdc4139491b0dd963eb830b70bb8d6
SHA512 ed8d4777609024960a7037f42937de41c434df4ff7062b43f03f0060e326bdef7917e941c9d3db5a8ec7a65f4890ef3dd53c87401f9568e6f068f2930d558e61
SSDEEP 49152:V8qj1I+WQRuLxNJYtFAAkSRKPVujsdWiqUh7yloDqq59wfkOrwBnaN9R3+HgGK2w:zKlYL
TLSH
T156F55B6FB902112BCAB340B6EC3326C7E96019B583A2D627F1EC9F663F8085D5767354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blacklisted.certs

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security
Size 55KB
SHA256 b5e8205764b83f46b50187b2021de7c86a890df908a8d6c17275a68924f832c6
MD5 8f0e3440fffdbcaa9d26be4730492a66
SHA1 20a3e5a8ecbec20d41d7124120d264f61de96613
SHA512 c04528769ce780e730ef71803ca8191c217f571f62703daca273499b90e93101383a3699263458c205cd7a8733399c3c2ca6afc85b6843c2c5e2ba0890e762cb
SSDEEP 768:rn4LHAEcqrlANbX7qL1AdL3naP2rOpOQSvbOETyqp+Z+Ijt+M38ykbLIsS8e677c:rs2aVOQCbOETyqpmLjt1CLze0YKQN3F
TLSH
T1C943F723BB4A3B7106B21197629EE2D9F71D71662A734058728D430CB726F60C3776EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Size 3KB
SHA256 761aab2969883e9e5ea76df63ca404fb67673efc3f97def057f8e22517fc9518
MD5 6cbca5808b4a8613d2fed6fe4a84c449
SHA1 0135b30ebec03fb69d79cdc3126e608d9effb8b2
SHA512 4d9bf052aa124d07673c601cbfb83223b87369f7be7575a13e13c0d893e57849ba11e430b7769901782c26471528dfaa130996916451e1a7e38cf28468e44cfa
TLSH
T1627109B56DC5D288D50B957008B2860B936E505866041B3F0E08A3B92FBCECD5B15DFE
MD5 SHA1 SHA512 TLSH

Submit Download

local_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar
Size 3KB
SHA256 02f69a433405ea928c89a8aade74e5462282ccb9a9d30851312ed3459398f85c
MD5 360663f26c5584e6c6127254b261fa0c
SHA1 aee6515eede2ad7c697ba8a61bdd9359be3319d2
SHA512 e3920d5abbbe6b0e3029ed1e0b2ce1a53da6c7e728f635b12f00b1fd2eb6151fff74b9dc85ec0c0920f7fda440c1604d24ca766cdbcb78be3425088d97e00208
TLSH
T114711AB52E85E3ADF90BE0781013790F975541544784163F4540B7B20FADE896AA3DEE
MD5 SHA1 SHA512 TLSH

Submit Download

ID.txt

Path C:\Users\Admin\xmpCzqQrOmL\ID.txt
Size 47B
SHA256 47ecdde0e313e8f0ccddcbc0981cbe58b6d4b231f8f1b010bf091dfb3b8bf2f9
MD5 3f732ba235ae53f22f1690c33bd0537e
SHA1 e9a32c2a22e4f9212a0bb7f7c56cf9d6e877f710
SHA512 7c7dad456d31998a9b8ff975b5fac772bc12b2de7cb4501df6b5f02b346a6b875e892eb8e804171d7d8a3836e8ef652d1f4c48ccd37a3f13a6c688c22df58e71
MD5 SHA1 SHA512

Submit Download

LPZiwaCeIRf.jcCGXp

Path C:\Users\Admin\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp
Size 570KB
SHA256 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019
MD5 31f90d8a8a473074bfeef7972d5a39b2
SHA1 083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd
SHA512 bc8abbfba825303e38ed4a29d72af2a1f6d54592a14e53807defb0d24326ab540645e7b69f4fe5b79e9e3bb4dc10e5fda0281e852443700feea512db7654dc68
SSDEEP 12288:JME6KYOW/U7JA1T7hyiGuwtjXOi8KyI/qroUIRMZNmkq0pT8Kiy4:3YOAU1A1pULOi8Ky4qrohMZNuET8D
TLSH
T115C41207FEE8843DE8338A349D93D0727D462DED9C2A916B58560AD04A64C6F8F274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-1379-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1297-0x00007FFC9E440000-0x00007FFC9E450000-memory.dmp

Download

memory/800-1296-0x00007FFC9E440000-0x00007FFC9E450000-memory.dmp

Download

memory/800-1258-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1380-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1254-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1382-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1381-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1253-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1255-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/800-1256-0x00007FFCA0B70000-0x00007FFCA0B80000-memory.dmp

Download

memory/876-1246-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1572-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1395-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1372-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1217-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1243-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1239-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1371-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1237-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1135-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1903-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1232-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1172-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/876-1211-0x000001C5EF780000-0x000001C5EF781000-memory.dmp

Download

memory/1560-108-0x000001C11AC70000-0x000001C11AC80000-memory.dmp

Download

memory/1560-68-0x000001C11AB90000-0x000001C11ABA0000-memory.dmp

Download

memory/1560-11-0x000001C119010000-0x000001C119011000-memory.dmp

Download

memory/1560-1070-0x000001C11ABD0000-0x000001C11ABE0000-memory.dmp

Download

memory/1560-30-0x000001C119010000-0x000001C119011000-memory.dmp

Download

memory/1560-32-0x000001C11AB60000-0x000001C11AB70000-memory.dmp

Download

memory/1560-34-0x000001C11AB70000-0x000001C11AB80000-memory.dmp

Download

memory/1560-567-0x000001C119010000-0x000001C119011000-memory.dmp

Download

memory/1560-39-0x000001C11AB80000-0x000001C11AB90000-memory.dmp

Download

memory/1560-157-0x000001C11ACA0000-0x000001C11ACB0000-memory.dmp

Download

memory/1560-158-0x000001C11AD00000-0x000001C11AD10000-memory.dmp

Download

memory/1560-145-0x000001C119010000-0x000001C119011000-memory.dmp

Download

memory/1560-132-0x000001C11ACD0000-0x000001C11ACE0000-memory.dmp

Download

memory/1560-41-0x000001C11ABA0000-0x000001C11ABB0000-memory.dmp

Download

memory/1560-40-0x000001C11AB90000-0x000001C11ABA0000-memory.dmp

Download

memory/1560-1086-0x000001C11AD00000-0x000001C11AD10000-memory.dmp

Download

memory/1560-1085-0x000001C11ACF0000-0x000001C11AD00000-memory.dmp

Download

memory/1560-1084-0x000001C11ACE0000-0x000001C11ACF0000-memory.dmp

Download

memory/1560-1083-0x000001C11ACD0000-0x000001C11ACE0000-memory.dmp

Download

memory/1560-1082-0x000001C11ACC0000-0x000001C11ACD0000-memory.dmp

Download

memory/1560-1081-0x000001C11ACA0000-0x000001C11ACB0000-memory.dmp

Download

memory/1560-1080-0x000001C11ABC0000-0x000001C11ABD0000-memory.dmp

Download

memory/1560-1079-0x000001C11AC80000-0x000001C11AC90000-memory.dmp

Download

memory/1560-1078-0x000001C11AC70000-0x000001C11AC80000-memory.dmp

Download

memory/1560-1077-0x000001C11AC60000-0x000001C11AC70000-memory.dmp

Download

memory/1560-1076-0x000001C11AC50000-0x000001C11AC60000-memory.dmp

Download

memory/1560-1075-0x000001C11AC40000-0x000001C11AC50000-memory.dmp

Download

memory/1560-1074-0x000001C11AC20000-0x000001C11AC30000-memory.dmp

Download

memory/1560-1073-0x000001C11AC10000-0x000001C11AC20000-memory.dmp

Download

memory/1560-1072-0x000001C11ABF0000-0x000001C11AC00000-memory.dmp

Download

memory/1560-1071-0x000001C11ABE0000-0x000001C11ABF0000-memory.dmp

Download

memory/1560-1069-0x000001C11ABA0000-0x000001C11ABB0000-memory.dmp

Download

memory/1560-1068-0x000001C11AB90000-0x000001C11ABA0000-memory.dmp

Download

memory/1560-1067-0x000001C11AB80000-0x000001C11AB90000-memory.dmp

Download

memory/1560-1066-0x000001C11AB70000-0x000001C11AB80000-memory.dmp

Download

memory/1560-1065-0x000001C11AB60000-0x000001C11AB70000-memory.dmp

Download

memory/1560-1064-0x000001C11AC30000-0x000001C11AC40000-memory.dmp

Download

memory/1560-1063-0x000001C11A8F0000-0x000001C11AB60000-memory.dmp

Download

memory/1560-1061-0x000001C119010000-0x000001C119011000-memory.dmp

Download

memory/1560-42-0x000001C11ABB0000-0x000001C11ABC0000-memory.dmp

Download

memory/1560-139-0x000001C11ACF0000-0x000001C11AD00000-memory.dmp

Download

memory/1560-44-0x000001C11ABC0000-0x000001C11ABD0000-memory.dmp

Download

memory/1560-51-0x000001C11A8F0000-0x000001C11AB60000-memory.dmp

Download

memory/1560-52-0x000001C11ABF0000-0x000001C11AC00000-memory.dmp

Download

memory/1560-133-0x000001C11ACE0000-0x000001C11ACF0000-memory.dmp

Download

memory/1560-125-0x000001C11AC90000-0x000001C11ACA0000-memory.dmp

Download

memory/1560-50-0x000001C11ABE0000-0x000001C11ABF0000-memory.dmp

Download

memory/1560-122-0x000001C11ACC0000-0x000001C11ACD0000-memory.dmp

Download

memory/1560-49-0x000001C11ABD0000-0x000001C11ABE0000-memory.dmp

Download

memory/1560-119-0x000001C11ACB0000-0x000001C11ACC0000-memory.dmp

Download

memory/1560-118-0x000001C11AC80000-0x000001C11AC90000-memory.dmp

Download

memory/1560-62-0x000001C11AB60000-0x000001C11AB70000-memory.dmp

Download

memory/1560-61-0x000001C11AC30000-0x000001C11AC40000-memory.dmp

Download

memory/1560-60-0x000001C11AC20000-0x000001C11AC30000-memory.dmp

Download

memory/1560-65-0x000001C11AC40000-0x000001C11AC50000-memory.dmp

Download

memory/1560-2-0x000001C11A8F0000-0x000001C11AB60000-memory.dmp

Download

memory/1560-64-0x000001C11AB70000-0x000001C11AB80000-memory.dmp

Download

memory/1560-59-0x000001C11AC10000-0x000001C11AC20000-memory.dmp

Download

memory/1560-106-0x000001C11ACA0000-0x000001C11ACB0000-memory.dmp

Download

memory/1560-58-0x000001C11AC00000-0x000001C11AC10000-memory.dmp

Download

memory/1560-70-0x000001C11AC50000-0x000001C11AC60000-memory.dmp

Download

memory/1560-69-0x000001C11ABA0000-0x000001C11ABB0000-memory.dmp

Download

memory/1560-103-0x000001C11AC40000-0x000001C11AC50000-memory.dmp

Download

memory/1560-1027-0x000001C11ACB0000-0x000001C11ACC0000-memory.dmp

Download

memory/1560-105-0x000001C11AC50000-0x000001C11AC60000-memory.dmp

Download

memory/1560-95-0x000001C11AC00000-0x000001C11AC10000-memory.dmp

Download

memory/1560-96-0x000001C11AC10000-0x000001C11AC20000-memory.dmp

Download

memory/1560-67-0x000001C11AB80000-0x000001C11AB90000-memory.dmp

Download

memory/1560-98-0x000001C11AC30000-0x000001C11AC40000-memory.dmp

Download

memory/1560-76-0x000001C11ABB0000-0x000001C11ABC0000-memory.dmp

Download

memory/1560-80-0x000001C11ABC0000-0x000001C11ABD0000-memory.dmp

Download

memory/1560-89-0x000001C11ABF0000-0x000001C11AC00000-memory.dmp

Download

memory/1560-75-0x000001C11AC70000-0x000001C11AC80000-memory.dmp

Download

memory/1560-74-0x000001C11AC60000-0x000001C11AC70000-memory.dmp

Download

memory/1560-84-0x000001C11ABE0000-0x000001C11ABF0000-memory.dmp

Download

memory/1560-83-0x000001C11ABD0000-0x000001C11ABE0000-memory.dmp

Download

memory/1560-81-0x000001C11AC80000-0x000001C11AC90000-memory.dmp

Download

memory/1560-86-0x000001C11AC90000-0x000001C11ACA0000-memory.dmp

Download

memory/4524-109-0x0000026202FF0000-0x0000026203000000-memory.dmp

Download

memory/4524-138-0x0000026202FD0000-0x0000026202FE0000-memory.dmp

Download

memory/4524-82-0x0000026202FA0000-0x0000026202FB0000-memory.dmp

Download

memory/4524-1026-0x0000026203000000-0x0000026203010000-memory.dmp

Download

memory/4524-20-0x0000026202D30000-0x0000026202FA0000-memory.dmp

Download

memory/4524-904-0x0000026201450000-0x0000026201451000-memory.dmp

Download

memory/4524-677-0x0000026202FF0000-0x0000026203000000-memory.dmp

Download

memory/4524-99-0x0000026202FD0000-0x0000026202FE0000-memory.dmp

Download

memory/4524-71-0x0000026201450000-0x0000026201451000-memory.dmp

Download

memory/4524-97-0x0000026202FC0000-0x0000026202FD0000-memory.dmp

Download

memory/4524-104-0x0000026202FE0000-0x0000026202FF0000-memory.dmp

Download

memory/4524-413-0x0000026201450000-0x0000026201451000-memory.dmp

Download

memory/4524-1123-0x0000026203010000-0x0000026203020000-memory.dmp

Download

memory/4524-57-0x0000026202D30000-0x0000026202FA0000-memory.dmp

Download

memory/4524-134-0x0000026202FC0000-0x0000026202FD0000-memory.dmp

Download

memory/4524-140-0x0000026203020000-0x0000026203030000-memory.dmp

Download

memory/4524-90-0x0000026202FB0000-0x0000026202FC0000-memory.dmp

Download

memory/4524-1212-0x0000026203020000-0x0000026203030000-memory.dmp

Download

memory/4524-131-0x0000026202FB0000-0x0000026202FC0000-memory.dmp

Download

memory/4524-126-0x0000026203010000-0x0000026203020000-memory.dmp

Download

memory/4524-141-0x0000026202FE0000-0x0000026202FF0000-memory.dmp

Download

memory/4524-113-0x0000026203000000-0x0000026203010000-memory.dmp

Download

memory/4524-121-0x0000026202FA0000-0x0000026202FB0000-memory.dmp

Download

memory/4704-1260-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1230-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1220-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1223-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1768-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1194-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1183-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1452-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1315-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1093-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1225-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1261-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1271-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1897-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1273-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1917-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download

memory/4704-1918-0x000001B1DD520000-0x000001B1DD521000-memory.dmp

Download