adwind | 140b8618c7ebfb3c74f6c96ae80bb18f7ad11e3a6af5160195413165bf445346

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-06-2022 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pendiente factura 2022.jar
Size

642KB
MD5

8653da73c76f1278d597ef1cb0629ec8
SHA1

99c880ec39db27f12394aad675be3e89503ad53c
SHA256

140b8618c7ebfb3c74f6c96ae80bb18f7ad11e3a6af5160195413165bf445346
SHA512

c6e39922fc54516dc5e34ca00cf283dcceccad8198aabf07dae6ba60e1a089ac8c3f3a7d727a32dc90f32df2cec512fd01cf7b9cd687967ab24c934394d8e2f4

Score

10^/10

adwind vjw0rm evasion persistence trojan worm

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exe

flow	pid	process
12	3432	WScript.exe
26	3432	WScript.exe
35	3432	WScript.exe
37	3432	WScript.exe
38	3432	WScript.exe
41	3432	WScript.exe
42	3432	WScript.exe
43	3432	WScript.exe
44	3432	WScript.exe
45	3432	WScript.exe
46	3432	WScript.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

javaw.exejava.exe

pid process

624 javaw.exe
2844 java.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Main.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Svc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuarScanner.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Proxy.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cis.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCDBlog.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filwscc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsorsp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NS.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7PSSrvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANNER.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcod.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANWSCS.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanosvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QUHLPSVC.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavUpdater.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiProxy.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quamgr.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Proxy.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSvcHost.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Main.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIEWTCP.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nbrowser.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldCCC.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCDBlog.exe\debugger = "svchost.exe"	regedit.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CxyqUjwokY.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CxyqUjwokY.js	WScript.exe

Loads dropped DLL 18 IoCs

Processes:

javaw.exejava.exe

pid	process
624	javaw.exe
624	javaw.exe
624	javaw.exe
624	javaw.exe
624	javaw.exe
624	javaw.exe
624	javaw.exe
2844	java.exe
2844	java.exe
2844	java.exe
2844	java.exe
624	javaw.exe
2844	java.exe
2844	java.exe
624	javaw.exe
2844	java.exe
2844	java.exe
624	javaw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\CxyqUjwokY.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfMzgLLEroq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\xOKLiazHFvb\\jwpCOOcEBxI.KPqBSK\""	reg.exe

Drops file in System32 directory 2 IoCs

Processes:

javaw.exejavaw.exe

description ioc process

File created C:\Windows\System32\test.txt javaw.exe
File opened for modification C:\Windows\System32\test.txt javaw.exe

description	ioc	process
File created	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2232 taskkill.exe
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings wscript.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1164 reg.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1448 regedit.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2232 taskkill.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

javaw.exejava.exejavaw.exe

pid process

3384 javaw.exe
3536 java.exe
624 javaw.exe

pid	process
2232	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	wscript.exe

pid	process
1164	reg.exe

pid	process
1448	regedit.exe

description	pid	process
Token: SeDebugPrivilege	2232	taskkill.exe

pid	process
3384	javaw.exe
3536	java.exe
624	javaw.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

java.exewscript.exejavaw.execmd.execmd.exejavaw.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1424 wrote to memory of 3428	1424	java.exe	wscript.exe
PID 1424 wrote to memory of 3428	1424	java.exe	wscript.exe
PID 3428 wrote to memory of 3432	3428	wscript.exe	WScript.exe
PID 3428 wrote to memory of 3432	3428	wscript.exe	WScript.exe
PID 3428 wrote to memory of 3384	3428	wscript.exe	javaw.exe
PID 3428 wrote to memory of 3384	3428	wscript.exe	javaw.exe
PID 3384 wrote to memory of 3536	3384	javaw.exe	java.exe
PID 3384 wrote to memory of 3536	3384	javaw.exe	java.exe
PID 3384 wrote to memory of 3996	3384	javaw.exe	cmd.exe
PID 3384 wrote to memory of 3996	3384	javaw.exe	cmd.exe
PID 3996 wrote to memory of 5052	3996	cmd.exe	cscript.exe
PID 3996 wrote to memory of 5052	3996	cmd.exe	cscript.exe
PID 3384 wrote to memory of 3772	3384	javaw.exe	cmd.exe
PID 3384 wrote to memory of 3772	3384	javaw.exe	cmd.exe
PID 3772 wrote to memory of 3880	3772	cmd.exe	cscript.exe
PID 3772 wrote to memory of 3880	3772	cmd.exe	cscript.exe
PID 3384 wrote to memory of 4492	3384	javaw.exe	xcopy.exe
PID 3384 wrote to memory of 4492	3384	javaw.exe	xcopy.exe
PID 3384 wrote to memory of 5096	3384	javaw.exe	cmd.exe
PID 3384 wrote to memory of 5096	3384	javaw.exe	cmd.exe
PID 3384 wrote to memory of 1164	3384	javaw.exe	reg.exe
PID 3384 wrote to memory of 1164	3384	javaw.exe	reg.exe
PID 3384 wrote to memory of 2384	3384	javaw.exe	attrib.exe
PID 3384 wrote to memory of 2384	3384	javaw.exe	attrib.exe
PID 3384 wrote to memory of 3632	3384	javaw.exe	attrib.exe
PID 3384 wrote to memory of 3632	3384	javaw.exe	attrib.exe
PID 3384 wrote to memory of 624	3384	javaw.exe	javaw.exe
PID 3384 wrote to memory of 624	3384	javaw.exe	javaw.exe
PID 624 wrote to memory of 2844	624	javaw.exe	java.exe
PID 624 wrote to memory of 2844	624	javaw.exe	java.exe
PID 624 wrote to memory of 2888	624	javaw.exe	cmd.exe
PID 624 wrote to memory of 2888	624	javaw.exe	cmd.exe
PID 2888 wrote to memory of 1956	2888	cmd.exe	cscript.exe
PID 2888 wrote to memory of 1956	2888	cmd.exe	cscript.exe
PID 624 wrote to memory of 4636	624	javaw.exe	cmd.exe
PID 624 wrote to memory of 4636	624	javaw.exe	cmd.exe
PID 4636 wrote to memory of 2868	4636	cmd.exe	cscript.exe
PID 4636 wrote to memory of 2868	4636	cmd.exe	cscript.exe
PID 624 wrote to memory of 2100	624	javaw.exe	cmd.exe
PID 624 wrote to memory of 2100	624	javaw.exe	cmd.exe
PID 624 wrote to memory of 2232	624	javaw.exe	taskkill.exe
PID 624 wrote to memory of 2232	624	javaw.exe	taskkill.exe
PID 624 wrote to memory of 4480	624	javaw.exe	cmd.exe
PID 624 wrote to memory of 4480	624	javaw.exe	cmd.exe
PID 4480 wrote to memory of 1448	4480	cmd.exe	regedit.exe
PID 4480 wrote to memory of 1448	4480	cmd.exe	regedit.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

3632 attrib.exe
2384 attrib.exe

pid	process
3632	attrib.exe
2384	attrib.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\pendiente factura 2022.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\haenngeamw.js
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CxyqUjwokY.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:3432
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\pwnhuynq.txt"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Program Files\Java\jre1.8.0_66\bin\java.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.75097255310467998590123567204741202.class
      4⤵
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:3536
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive552195072238465735.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive552195072238465735.vbs
        5⤵
        
        PID:5052
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5893767175801920072.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5893767175801920072.vbs
        5⤵
        
        PID:3880
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:4492
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\xOKLiazHFvb\jwpCOOcEBxI.KPqBSK
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:624
    - - C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.61364731875151071582352327475620567.class
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2844
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4343391496485147765.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4343391496485147765.vbs
        6⤵
        
        PID:1956
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2434727865329086733.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2434727865329086733.vbs
        6⤵
        
        PID:2868
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2100
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM UserAccountControlSettings.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\MJqmvBtjBQ2009237189214006721.reg
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4480
      - C:\Windows\regedit.exe
        
        regedit.exe /s C:\Users\Admin\AppData\Local\Temp\MJqmvBtjBQ2009237189214006721.reg
        6⤵
        UAC bypass
        Sets file execution options in registry
        Runs .reg file with regedit
        
        PID:1448
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\xOKLiazHFvb"
      4⤵
      Views/modifies file attributes
      PID:3632
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\xOKLiazHFvb\*.*"
      4⤵
      Views/modifies file attributes
      PID:2384
  - - C:\Windows\SYSTEM32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v lfMzgLLEroq /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\xOKLiazHFvb\jwpCOOcEBxI.KPqBSK\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\50569f7db71fa7f8.timestamp

Filesize
54B

MD5
87d8e1e8d2fd23ecf592c461688ed941

SHA1
dd35646c4f4140ec08ea0d5e693b4c3af8448be5

SHA256
171c75c8137700a8608c1f5c70ca7470c225b6695ad200b2ec64b86d127aa9ae

SHA512
50b22d018a5f2e8f1b19575362c9e56b4c263ea8ddd7074d6415e0896d9e01a11412d58f618bb1177ef8b0e8f86d62cc89e7037d29d154cf2bda95285249c4dd

Download Submit
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
9416061f3fb78b7d62cf25187059b4f0

SHA1
964ac8411d8cc72b1ece534b22092244e905fe72

SHA256
65137e3b012b841b374e71b0d24daf2737ee79bdba85379e588e06d55be7ae61

SHA512
5067c1f7138e6dd04ae2b0974b650b56c58242c89189f70cbcfde282a0b21cc97a5f1cdeeae4eff41e85ca3540053dc672316fbaac584dbfa0cf65a70ea209e7

Download Submit
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
5692c15cb54197ac76011717793f3799

SHA1
cb33aad8e34d722e237a6d7d7e533b79f0da2fea

SHA256
2db207b13629098dc4cb14946854e0bc7a7ed6998f4a982f3a74fa2b475dbc31

SHA512
27745a733d2108971c587eb57b3880233ebbfb5417c9a5fc28e881559568f484a2f28986a411e326679a902e872a24c442f0b725b5c8e344102fa5434bf1e389

Download Submit
C:\Users\Admin\AppData\Local\Temp\MJqmvBtjBQ2009237189214006721.reg

Filesize
27KB

MD5
7f97f5f336944d427c03cc730c636b8f

SHA1
8a50c72b4580c20d4a7bfc7af8f12671bf6715ae

SHA256
9613caed306e9a267c62c56506985ef99ea2bee6e11afc185b8133dda37cbc57

SHA512
8f8b5dc16f087bdc73a134b76fd1063765e3c049baca4873d1b9eb30ba59f418395490cafc78a93b1cdcc20461e73c96de34475669715d6ddb93d0b56e6e6c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive2434727865329086733.vbs

Filesize
281B

MD5
a32c109297ed1ca155598cd295c26611

SHA1
dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

SHA256
45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

SHA512
70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive4343391496485147765.vbs

Filesize
276B

MD5
3bdfd33017806b85949b6faa7d4b98e4

SHA1
f92844fee69ef98db6e68931adfaa9a0a0f8ce66

SHA256
9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

SHA512
ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive552195072238465735.vbs

Filesize
276B

MD5
3bdfd33017806b85949b6faa7d4b98e4

SHA1
f92844fee69ef98db6e68931adfaa9a0a0f8ce66

SHA256
9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

SHA512
ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive5893767175801920072.vbs

Filesize
281B

MD5
a32c109297ed1ca155598cd295c26611

SHA1
dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

SHA256
45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

SHA512
70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.61364731875151071582352327475620567.class

Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.75097255310467998590123567204741202.class

Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Roaming\CxyqUjwokY.js

Filesize
37KB

MD5
03cfba8ce2fc84f765b9ba934dd9b475

SHA1
cd2e13b54e98d98d55e36d4af0792abd324feace

SHA256
8e481b8d135914fbb5f4ff4a64f19f4a6f91a2ed032bcca12ec8cc3a418151eb

SHA512
f5a9aa95cfba74699fb042d9d508326f36820b15e5e68b4a10018aefed460eefc2c51347c78b8ae8b9db7e852136562695732d4cd70ed1133efb10b010b15326

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2632097139-1792035885-811742494-1000\83aa4cc77f591dfc2374580bbd95f6ba_2c37a701-1043-4f89-b4d1-d05ed25c6971

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

Filesize
1.4MB

MD5
68930e83a010c461b783ab4a1d043932

SHA1
3f9c4e63dc60de5b7d5b872ac89d864fafab159b

SHA256
3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b

SHA512
458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

Filesize
1.4MB

MD5
68930e83a010c461b783ab4a1d043932

SHA1
3f9c4e63dc60de5b7d5b872ac89d864fafab159b

SHA256
3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b

SHA512
458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Filesize
155KB

MD5
ce330d52fc60db54ddfb463ad2280722

SHA1
9506dfdaf3db5636a45b6e06006670387c62746c

SHA256
ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9

SHA512
56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Filesize
155KB

MD5
ce330d52fc60db54ddfb463ad2280722

SHA1
9506dfdaf3db5636a45b6e06006670387c62746c

SHA256
ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9

SHA512
56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Filesize
155KB

MD5
ce330d52fc60db54ddfb463ad2280722

SHA1
9506dfdaf3db5636a45b6e06006670387c62746c

SHA256
ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9

SHA512
56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

Filesize
202KB

MD5
faf8c06436a9ce2c2e27d83a2639319d

SHA1
94c62a85b019936658627ad916c1477f6a1c6df9

SHA256
2713dfebcf17ecd17c6d21104846bc14fe1c8d4981de886d1cc2d194c7dfcf4b

SHA512
9ac580ad17ed2aae97001cd137e3686e7c97e7e97ed820b3f4c886419d54d067441f3a85711fc9b24c9ce0c4895c483693c1fb8f2eb369a7f3ef52b0642b1bb2

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

Filesize
202KB

MD5
aa120c29e7202ce9ae9c0752284c7e36

SHA1
94e7d33ccab298c67b1cc816d3c228cc7e6b84e4

SHA256
449036069e2bfe7ec052a614be07ad7105a3203d974d46423c0c32d6ce888661

SHA512
1442856f08213f4a356cd404c50a65a12b908f6fb86c299d636af595577ef8af82294ad4237fbb025578b946e8f179b9eed0f6d6c4aa88970bfb228ae8c767f8

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

Filesize
36KB

MD5
3bce03cc24cb8e4a36c6beb71d98e850

SHA1
2c0423efd5a3dcd54ac8d9805c0ca0aace2f2097

SHA256
f54990046c77bc5a62f06969ad78039b19c4681d09f4ab1c5112de5a87433631

SHA512
2a20899efb6d8417c9312c578f1d519cb21559a162b839ec2db7a6e81de99c025d1dbcbdbc330a078e5acb4a53ecdf514e7ba7444b18fa9ce7b8da6cfd0e4253

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

Filesize
36KB

MD5
3bce03cc24cb8e4a36c6beb71d98e850

SHA1
2c0423efd5a3dcd54ac8d9805c0ca0aace2f2097

SHA256
f54990046c77bc5a62f06969ad78039b19c4681d09f4ab1c5112de5a87433631

SHA512
2a20899efb6d8417c9312c578f1d519cb21559a162b839ec2db7a6e81de99c025d1dbcbdbc330a078e5acb4a53ecdf514e7ba7444b18fa9ce7b8da6cfd0e4253

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

Filesize
809KB

MD5
df3ca8d16bded6a54977b30e66864d33

SHA1
b7b9349b33230c5b80886f5c1f0a42848661c883

SHA256
1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

SHA512
951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

Filesize
809KB

MD5
df3ca8d16bded6a54977b30e66864d33

SHA1
b7b9349b33230c5b80886f5c1f0a42848661c883

SHA256
1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

SHA512
951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

Filesize
809KB

MD5
df3ca8d16bded6a54977b30e66864d33

SHA1
b7b9349b33230c5b80886f5c1f0a42848661c883

SHA256
1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

SHA512
951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Filesize
92KB

MD5
86588a13a4acb85da6aaea8ec495205c

SHA1
07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95

SHA256
b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63

SHA512
7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Filesize
92KB

MD5
86588a13a4acb85da6aaea8ec495205c

SHA1
07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95

SHA256
b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63

SHA512
7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Filesize
92KB

MD5
86588a13a4acb85da6aaea8ec495205c

SHA1
07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95

SHA256
b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63

SHA512
7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Filesize
59KB

MD5
7a04210ba8c986ea53b4f4f685cf9c42

SHA1
90ee52ad6ac4565977c05999240696587bfff955

SHA256
e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6

SHA512
ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Filesize
59KB

MD5
7a04210ba8c986ea53b4f4f685cf9c42

SHA1
90ee52ad6ac4565977c05999240696587bfff955

SHA256
e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6

SHA512
ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Filesize
59KB

MD5
7a04210ba8c986ea53b4f4f685cf9c42

SHA1
90ee52ad6ac4565977c05999240696587bfff955

SHA256
e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6

SHA512
ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Filesize
8.4MB

MD5
ef745af1ddd4826d206f1942fa0e4b6f

SHA1
3260b76ca72e6ac80f8551d8fcba9926438cd838

SHA256
ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8

SHA512
cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Filesize
8.4MB

MD5
ef745af1ddd4826d206f1942fa0e4b6f

SHA1
3260b76ca72e6ac80f8551d8fcba9926438cd838

SHA256
ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8

SHA512
cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Filesize
8.4MB

MD5
ef745af1ddd4826d206f1942fa0e4b6f

SHA1
3260b76ca72e6ac80f8551d8fcba9926438cd838

SHA256
ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8

SHA512
cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Filesize
131KB

MD5
89ab2a94e87122dffec8dfc347615cc0

SHA1
1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e

SHA256
f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e

SHA512
0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Filesize
131KB

MD5
89ab2a94e87122dffec8dfc347615cc0

SHA1
1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e

SHA256
f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e

SHA512
0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Filesize
131KB

MD5
89ab2a94e87122dffec8dfc347615cc0

SHA1
1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e

SHA256
f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e

SHA512
0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Filesize
48KB

MD5
b140730c68a0d3e52d4533f4fb32dce8

SHA1
82687e557c57534f1e54f14a016eaac0f375e83d

SHA256
88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943

SHA512
9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Filesize
48KB

MD5
b140730c68a0d3e52d4533f4fb32dce8

SHA1
82687e557c57534f1e54f14a016eaac0f375e83d

SHA256
88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943

SHA512
9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Filesize
48KB

MD5
b140730c68a0d3e52d4533f4fb32dce8

SHA1
82687e557c57534f1e54f14a016eaac0f375e83d

SHA256
88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943

SHA512
9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Filesize
75KB

MD5
a56686411fc41f3abeea19f129935ee9

SHA1
6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6

SHA256
0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec

SHA512
be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Filesize
75KB

MD5
a56686411fc41f3abeea19f129935ee9

SHA1
6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6

SHA256
0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec

SHA512
be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Filesize
75KB

MD5
a56686411fc41f3abeea19f129935ee9

SHA1
6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6

SHA256
0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec

SHA512
be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties

Filesize
149B

MD5
2ed483df31645d3d00c625c00c1e5a14

SHA1
27c9b302d2d47aae04fc1f4ef9127a2835a77853

SHA256
68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf

SHA512
4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

Filesize
634B

MD5
499f2a4e0a25a41c1ff80df2d073e4fd

SHA1
e2469cbe07e92d817637be4e889ebb74c3c46253

SHA256
80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

SHA512
7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index

Filesize
1KB

MD5
005faac2118450bfcd46ae414da5f0e5

SHA1
9f5c887e0505e1bb06bd1fc7975a3219709d061d

SHA256
f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8

SHA512
8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar

Filesize
38KB

MD5
a269905bbb9f7d02baa24a756e7b09d7

SHA1
82a0f9c5cbc2b79bdb6cfe80487691e232b26f9c

SHA256
e2787698d746dc25c24d3be0fa751cea6267f68b4e972cfc3df4b4eac8046245

SHA512
496841cf49e2bf4eb146632f7d1f09efa8f38ae99b93081af4297a7d8412b444b9f066358f0c110d33fea6ae60458355271d8fdcd9854c02efb2023af5f661f6

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar

Filesize
272KB

MD5
2c8eb358076f9af81048f0295ecd1e8d

SHA1
29820464260229b133c39965832ec39ba1b5e363

SHA256
3acb15d471dc1749e28be6cbff6c16dd4d81eeb7f5d89e61f4964ee3b570cbc4

SHA512
5028f26b40451c395543a1d4096c8ee12075bd44bf7dadc9321c84fa77190e0afee8e9882ef45b78aa1bb2d10af383ec4e5881e2a51216b5f20eb994c243d673

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar

Filesize
112KB

MD5
93070881a5c582e0147b0b71cf64fc85

SHA1
58b95b2da2ea5a049b31647cdcd59539ae1240a4

SHA256
72ed3462f55fc833e2b753b70e1ef5268c189490f5a41aa716cc9a6596455907

SHA512
cde37e5e79afeac2aacb9e4059224bec32223a20bd7dc0562ce9617dfdd9072a238553e92fce73eec0e562ae0b685ee3717b1ec5f7c1bb17bea10ec596a58169

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar

Filesize
556KB

MD5
e4263de270b7e77aff4aa979d856e9f4

SHA1
550b1f9a5eefdebc3474f72d6eca3567edf160e9

SHA256
87d5757d5858b8db77b8b48b74bcc1b7abb953cf4eca404326b355954511e563

SHA512
e3cdd4f9c3f07a7f7540c7ef6069452021c71a9bc1ac25d4fb4042855dfb0767c6163bc832f8770b150cec8cf3f4476cfff545339b83b19f94d09a3b077163a0

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

Filesize
2KB

MD5
91aa6ea7320140f30379f758d626e59d

SHA1
3be2febe28723b1033ccdaa110eaf59bbd6d1f96

SHA256
4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

SHA512
03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\net.properties

Filesize
2KB

MD5
19a5c7f5186854362281a152e756ce2f

SHA1
cc738221f126334de60d73b5db63789c41e282ac

SHA256
5d62f39e6eb46c7a731b6997a14acfeb63f5c95dfcef8de3d4d94b5d571372c6

SHA512
24e3489b825015226c7c2a1ac6cc2d20d5056c8d578d612f73a35aa43a953cfe331fd6cbdc251ce23cfaa403130848822dd3efb30ed427f25a1221ba0a2b2bf3

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar

Filesize
3.3MB

MD5
34b24a98bd43143f16fa0bca098c9a47

SHA1
40c306107ee9e284c89d92ce40d4abe511c202f8

SHA256
d9d8328c652819cba0a9f332aa65d2ed86f08ab8c2dc55353ac640cd687fad4b

SHA512
e8e330f60d3d7ef1e79988117ea06a0dbb69aad3a19c8c08e2473fe8b64b041375a719d4605cfc3e50567a0413d58ed52c3caf6d0b971c8cae3878fbade35295

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar

Filesize
51.9MB

MD5
e590e2382f3b255f1f0d1bccac903a4c

SHA1
8bee386ea8754e8280d76145dd9ce530a1ee3f56

SHA256
4528de2bab92a64877eab990133d692b91390f2d021950cfca45df42c4798369

SHA512
dd38d8eea0cc1fc029c1c284267bf59a091b54c6965361b3a8e78997739794fd768e0c9adb46d6ea1e39f059f770e0f3aecc814f8bee2e3987ff7a6b06b76438

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\US_export_policy.jar

Filesize
2KB

MD5
ee4ed9c75a1aaa04dfd192382c57900c

SHA1
7d69ea3b385bc067738520f1b5c549e1084be285

SHA256
90012f900cf749a0e52a0775966ef575d390ad46388c49d512838983a554a870

SHA512
eae6a23d2fd7002a55465844e662d7a5e3ed5a6a8baf7317897e59a92a4b806dd26f2a19b7c05984745050b4fe3ffa30646a19c0f08451440e415f958204137c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs

Filesize
1KB

MD5
91c7195d1abf0081758ce00c8248732c

SHA1
9f8852ffcba434070e23dc2e1f22b3b284ba8854

SHA256
a8e6daf874fa9854c80eb6aba7b4d327b641f74d95033adc2a80c6d6d0ba26e2

SHA512
c1d464158aa86c622becb197c0f95c9d2b24d5e9cd38707ae47e6d7b2f614cb1f99f146c9288e1e93c6b103b0e78471544ca1b08bb08d24bfde758e894626377

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security

Filesize
26KB

MD5
d81c4d59c02c525dba1398235dc278c9

SHA1
f71af6018024dfef946910e95151190e95d08c59

SHA256
4466d783bffeee009e3ca12a8e6c6318ff622408fc50dfc9ae529830dece56b3

SHA512
4551d2959adced83d7024f813941b12fd0239a4c5bdffdf2a9e78b9e08a1163e045317dbb91097c2ef9c0a5de556b44ca1b201b1c9fe23cb977e2daac29bb276

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\local_policy.jar

Filesize
3KB

MD5
57aaaa3176dc28fc554ef0906d01041a

SHA1
238b8826e110f58acb2e1959773b0a577cd4d569

SHA256
b8becc3ef2e7ff7d2165dd1a4e13b9c59fd626f20a26af9a32277c1f4b5d5bc7

SHA512
8704b5e3665f28d1a0bc2a063f4bc07ba3c7cd8611e06c0d636a91d5ea55f63e85c6d2ad49e5d8ece267d43ca3800b3cd09cf369841c94d30692eb715bb0098e

Download Submit
C:\Users\Admin\AppData\Roaming\pwnhuynq.txt

Filesize
479KB

MD5
0af2ffb0e3a810f556a0eef909a5ecc7

SHA1
641fe60bfa8569a0a13dc9279ea1cafb5cb912ad

SHA256
9d05feba177ac6b9433f0a28bf9e6ba9828f1621f625f7ca80009a1cf5b5374b

SHA512
883f01a0d0c2ed6ada0dd3d2b4548d01b54f6cf4fcfd6a39f9a61511147fefc4ea8ad4392873fd54e4d7c1c04adc01c94bf99447ddfcde925340ae4ea409b1c9

Download Submit
C:\Users\Admin\haenngeamw.js

Filesize
991KB

MD5
36f2a04a3d39100d7f6b3e2459db9f7c

SHA1
3d2ce108946bbb1a8db0ed749ed2747f16dfe22c

SHA256
83e33d5b01f9b4c514644b8078c99d3799bb5eb674d04906a3a3feb829ac61a6

SHA512
581de3b51ee5d464b4cfab23377f326a397cba459c42ce1f57585cf9a7ad93cd4d342b6da57c5a712be3d9c944e58d0cfb42bc9e7ebe598e2c0c477fa211f92b

Download Submit
C:\Users\Admin\xOKLiazHFvb\ID.txt

Filesize
47B

MD5
a38bc76e5d25fd8839d77e4f01946089

SHA1
db26bdeb3599bda05b8b2a3fa24e954970965c73

SHA256
75584204ae1ca022052e7131a673c1ae7bc6beda4d654277a090f0906b1c07c6

SHA512
122b8473c5d4727197d8138916d5dd19e37f60223aa27a48b0f2c236d9d9f0798c6e5cc4d8e514a2b63d2473c168ba217d7a41e062f702f6c5af43bbd2e0369e

Download Submit
C:\Users\Admin\xOKLiazHFvb\jwpCOOcEBxI.KPqBSK

Filesize
479KB

MD5
0af2ffb0e3a810f556a0eef909a5ecc7

SHA1
641fe60bfa8569a0a13dc9279ea1cafb5cb912ad

SHA256
9d05feba177ac6b9433f0a28bf9e6ba9828f1621f625f7ca80009a1cf5b5374b

SHA512
883f01a0d0c2ed6ada0dd3d2b4548d01b54f6cf4fcfd6a39f9a61511147fefc4ea8ad4392873fd54e4d7c1c04adc01c94bf99447ddfcde925340ae4ea409b1c9

Download Submit
C:\Windows\System32\test.txt

Filesize
814B

MD5
934cae41c23c28fe5053221007ce9c91

SHA1
03b0f59141bdc7625ef61609a82faa72034121da

SHA256
b73f4ac7c39041d10f1dff3b36720ed89ca8c2c83c0844b0d525b01651391063

SHA512
41efa8419b1138cad31fd5e5aeded0b5f65a89715a6733f5a81645be22836326278dfe1a99b8c493baf7e0493024f6b649a120b9c3c8085adf5263cfaaaa74c5

Download Submit
memory/624-234-0x00000000032D0000-0x00000000042D0000-memory.dmp

Filesize
16.0MB

Download
memory/624-206-0x0000000000000000-mapping.dmp

Download
memory/624-300-0x00000000032D0000-0x00000000042D0000-memory.dmp

Filesize
16.0MB

Download
memory/624-296-0x00000000032D0000-0x00000000042D0000-memory.dmp

Filesize
16.0MB

Download
memory/624-305-0x00000000032D0000-0x00000000042D0000-memory.dmp

Filesize
16.0MB

Download
memory/624-302-0x00000000032D0000-0x00000000042D0000-memory.dmp

Filesize
16.0MB

Download
memory/624-303-0x00000000032D0000-0x00000000042D0000-memory.dmp

Filesize
16.0MB

Download
memory/1164-203-0x0000000000000000-mapping.dmp

Download
memory/1424-139-0x0000000003260000-0x0000000004260000-memory.dmp

Filesize
16.0MB

Download
memory/1448-294-0x0000000000000000-mapping.dmp

Download
memory/1956-276-0x0000000000000000-mapping.dmp

Download
memory/2100-284-0x0000000000000000-mapping.dmp

Download
memory/2232-288-0x0000000000000000-mapping.dmp

Download
memory/2384-204-0x0000000000000000-mapping.dmp

Download
memory/2844-271-0x0000000002F30000-0x0000000003F30000-memory.dmp

Filesize
16.0MB

Download
memory/2844-240-0x0000000000000000-mapping.dmp

Download
memory/2868-281-0x0000000000000000-mapping.dmp

Download
memory/2888-275-0x0000000000000000-mapping.dmp

Download
memory/3384-199-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-197-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-200-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-177-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-198-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-155-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-196-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-195-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-192-0x0000000002C20000-0x0000000003C20000-memory.dmp

Filesize
16.0MB

Download
memory/3384-145-0x0000000000000000-mapping.dmp

Download
memory/3428-140-0x0000000000000000-mapping.dmp

Download
memory/3432-143-0x0000000000000000-mapping.dmp

Download
memory/3536-304-0x0000000002B30000-0x0000000003B30000-memory.dmp

Filesize
16.0MB

Download
memory/3536-187-0x0000000002B30000-0x0000000003B30000-memory.dmp

Filesize
16.0MB

Download
memory/3536-158-0x0000000000000000-mapping.dmp

Download
memory/3536-170-0x0000000002B30000-0x0000000003B30000-memory.dmp

Filesize
16.0MB

Download
memory/3632-205-0x0000000000000000-mapping.dmp

Download
memory/3772-190-0x0000000000000000-mapping.dmp

Download
memory/3880-191-0x0000000000000000-mapping.dmp

Download
memory/3996-185-0x0000000000000000-mapping.dmp

Download
memory/4480-290-0x0000000000000000-mapping.dmp

Download
memory/4492-194-0x0000000000000000-mapping.dmp

Download
memory/4636-280-0x0000000000000000-mapping.dmp

Download
memory/5052-188-0x0000000000000000-mapping.dmp

Download
memory/5096-202-0x0000000000000000-mapping.dmp

Download