Analysis Overview
SHA256
590d68d18c4f1e312d351cfce5f9e0ffb1dfd16e80b5979f19155c7f2f843648
Threat Level: Known bad
The file 1b3565be9ec87bcb828af01ba25e9ff6 was found to be: Known bad.
Malicious Activity Summary
AsyncRat
AdWind
Async RAT payload
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Drops file in System32 directory
Drops file in Program Files directory
Enumerates physical storage devices
N/A.
Views/modifies file attributes
Runs .reg file with regedit
Modifies registry key
Suspicious use of SetWindowsHookEx
Modifies registry class
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Delays execution with timeout.exe
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-07-04 07:14
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-07-04 07:14
Reported
2022-07-04 07:17
Platform
win7-20220414-en
Max time kernel
146s
Max time network
150s
Command Line
Signatures
AdWind
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\AsyncClient.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\win.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\System32\test.txt | C:\Program Files\Java\jre7\bin\java.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\AsyncClient.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\AsyncClient.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\win.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre7\bin\java.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Re Order 4500324718-CIMELECT.jar"
C:\Windows\system32\wscript.exe
wscript C:\Users\Admin\slrtghxwgp.js
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\xRKCVudFNp.js"
C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bwbkyusyvl.txt"
C:\Users\Admin\AppData\Roaming\AsyncClient.exe
"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"
C:\Program Files\Java\jre7\bin\java.exe
"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.69496036936904772396323987121633275.class
C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2934314058063850074.vbs
C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive404031182877290472.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2934314058063850074.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive404031182877290472.vbs
C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6524257857729156963.vbs
C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7673477011849406345.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6524257857729156963.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7673477011849406345.vbs
C:\Windows\system32\xcopy.exe
xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
C:\Windows\system32\xcopy.exe
xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp92DE.tmp.bat""
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'
C:\Windows\SysWOW64\timeout.exe
timeout 3
C:\Windows\system32\cmd.exe
cmd.exe
C:\Users\Admin\AppData\Roaming\win.exe
"C:\Users\Admin\AppData\Roaming\win.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| US | 8.8.8.8:53 | franmhort.duia.ro | udp |
| CH | 91.192.100.8:8153 | franmhort.duia.ro | tcp |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| CH | 91.192.100.8:8153 | franmhort.duia.ro | tcp |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| CH | 91.192.100.8:8153 | franmhort.duia.ro | tcp |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| US | 8.8.8.8:53 | franmhort.duia.ro | udp |
| CH | 91.192.100.8:8153 | franmhort.duia.ro | tcp |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp | |
| N/A | 127.0.0.1:7777 | tcp |
Files
memory/872-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp
memory/872-64-0x00000000020C0000-0x00000000050C0000-memory.dmp
memory/1128-65-0x0000000000000000-mapping.dmp
C:\Users\Admin\slrtghxwgp.js
| MD5 | a0feff107f173acc9b411620b16cfddf |
| SHA1 | b7b5985ad225aef80e1e0e08297330f2257f7f59 |
| SHA256 | 100de96a9a0778b9d66d919de429cecb7ee54c4e3ddce9911d40a0ded003d185 |
| SHA512 | 99d7ca04f65e2cadd0678166a5b1c07e476873bd43c90290982731e3657bd43a4ddcfb57a1317381529eb50dd1dadd7e87273006f4179e43b4a3251184ed7000 |
memory/320-69-0x0000000000000000-mapping.dmp
memory/1712-70-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\xRKCVudFNp.js
| MD5 | 63649fb5e85e7f8c93a1ad99a27b7b22 |
| SHA1 | ae8e7a2215151a271d983e52ba8a56a77ae6baed |
| SHA256 | e5d86ad0a6d4aaf17667fc846727326d86608c9cbee572b6aef70c92b028d86d |
| SHA512 | 7bd802d530f5b752a8b9ec2e0e45ade04b70d0edf29b007852682e25cc3a63531fde3d2c57e03d5fb8478caeff823b028d9bd83ef693876d5f803868428d5f3a |
C:\Users\Admin\AppData\Roaming\bwbkyusyvl.txt
| MD5 | e6e49d6575a99dc7eaf81091e02190b6 |
| SHA1 | d7abf421d1a9d080d89b2922003a0d869d64ac2c |
| SHA256 | 3df792e3ab0c1efd66231647b0369e5805d359403d5b534a2562a7ba301b0757 |
| SHA512 | 98743a430ab0490aed350a800d057dbaf7b29d2ce9833ca7cefc3e52a18dc5918c315918f64b193ca6d42f0250f7d93f001606689852de3f56182de42e0a7d3f |
memory/1944-81-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\AsyncClient.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
C:\Users\Admin\AppData\Roaming\AsyncClient.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/1712-86-0x0000000002320000-0x0000000005320000-memory.dmp
memory/1944-87-0x00000000001F0000-0x0000000000202000-memory.dmp
memory/1676-88-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\_0.69496036936904772396323987121633275.class
| MD5 | 781fb531354d6f291f1ccab48da6d39f |
| SHA1 | 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68 |
| SHA256 | 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9 |
| SHA512 | 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8 |
memory/1676-97-0x0000000002290000-0x0000000005290000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1083475884-596052423-1669053738-1000\83aa4cc77f591dfc2374580bbd95f6ba_206ac020-9434-4197-af4e-48c8ff9cae6c
| MD5 | c8366ae350e7019aefc9d1e6e6a498c6 |
| SHA1 | 5731d8a3e6568a5f2dfbbc87e3db9637df280b61 |
| SHA256 | 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238 |
| SHA512 | 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd |
memory/1944-102-0x00000000764C1000-0x00000000764C3000-memory.dmp
memory/1760-105-0x0000000000000000-mapping.dmp
memory/240-106-0x0000000000000000-mapping.dmp
memory/1612-108-0x0000000000000000-mapping.dmp
memory/852-107-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive2934314058063850074.vbs
| MD5 | 3bdfd33017806b85949b6faa7d4b98e4 |
| SHA1 | f92844fee69ef98db6e68931adfaa9a0a0f8ce66 |
| SHA256 | 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6 |
| SHA512 | ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429 |
C:\Users\Admin\AppData\Local\Temp\Retrive404031182877290472.vbs
| MD5 | 3bdfd33017806b85949b6faa7d4b98e4 |
| SHA1 | f92844fee69ef98db6e68931adfaa9a0a0f8ce66 |
| SHA256 | 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6 |
| SHA512 | ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429 |
memory/1528-111-0x0000000000000000-mapping.dmp
memory/1868-112-0x0000000000000000-mapping.dmp
memory/588-113-0x0000000000000000-mapping.dmp
memory/1512-114-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive6524257857729156963.vbs
| MD5 | a32c109297ed1ca155598cd295c26611 |
| SHA1 | dc4a1fdbaad15ddd6fe22d3907c6b03727b71510 |
| SHA256 | 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7 |
| SHA512 | 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887 |
C:\Users\Admin\AppData\Local\Temp\Retrive7673477011849406345.vbs
| MD5 | a32c109297ed1ca155598cd295c26611 |
| SHA1 | dc4a1fdbaad15ddd6fe22d3907c6b03727b71510 |
| SHA256 | 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7 |
| SHA512 | 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887 |
memory/768-118-0x0000000000000000-mapping.dmp
memory/1540-117-0x0000000000000000-mapping.dmp
memory/1504-119-0x0000000000000000-mapping.dmp
memory/2012-120-0x0000000000000000-mapping.dmp
memory/1756-121-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\tmp92DE.tmp.bat
| MD5 | eb4df0d662ad53d1abd87630b22750a0 |
| SHA1 | 393a2033d99a9ca326416552bff24e434036fc38 |
| SHA256 | 9b7631b2f8871b965995d2752b47997475b567303338770d64829f010b468242 |
| SHA512 | 6daec5f20c5e8b1063bd21c814195e98bbf5fd38840a327713931332204271a232fb10bc93aece7925b724efdf4aab151f84e3cfcc777a515ee59a2bb7dc8cb6 |
memory/904-123-0x0000000000000000-mapping.dmp
memory/1616-124-0x0000000000000000-mapping.dmp
\Users\Admin\AppData\Roaming\win.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
C:\Users\Admin\AppData\Roaming\win.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/1580-127-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\win.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/1580-129-0x0000000000DF0000-0x0000000000E02000-memory.dmp
memory/1712-130-0x0000000002320000-0x0000000005320000-memory.dmp
memory/1676-132-0x0000000002290000-0x0000000005290000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-07-04 07:14
Reported
2022-07-04 07:17
Platform
win10v2004-20220414-en
Max time kernel
40s
Max time network
128s
Command Line
Signatures
AdWind
AsyncRat
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\AsyncClient.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation | C:\Windows\SYSTEM32\wscript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
Enumerates physical storage devices
N/A.
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings | C:\Windows\SYSTEM32\wscript.exe | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\reg.exe | N/A |
Runs .reg file with regedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\regedit.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\attrib.exe | N/A |
Processes
C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Re Order 4500324718-CIMELECT.jar"
C:\Windows\SYSTEM32\wscript.exe
wscript C:\Users\Admin\slrtghxwgp.js
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\xRKCVudFNp.js"
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\cyxnvzm.txt"
C:\Users\Admin\AppData\Roaming\AsyncClient.exe
"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"
C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.31762649914943015647649392174404845.class
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6407459440606450900.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6407459440606450900.vbs
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3698165362106108794.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3698165362106108794.vbs
C:\Windows\SYSTEM32\xcopy.exe
xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3E8.tmp.bat""
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'
C:\Windows\SysWOW64\timeout.exe
timeout 3
C:\Users\Admin\AppData\Roaming\win.exe
"C:\Users\Admin\AppData\Roaming\win.exe"
C:\Windows\SYSTEM32\cmd.exe
cmd.exe
C:\Windows\SYSTEM32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v spasIRSrHuv /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\gfrcMSvPbUA\fvadspBOUVV.yYgxrl\"" /f
C:\Windows\SYSTEM32\attrib.exe
attrib +h "C:\Users\Admin\gfrcMSvPbUA"
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\gfrcMSvPbUA\fvadspBOUVV.yYgxrl
C:\Windows\SYSTEM32\attrib.exe
attrib +h "C:\Users\Admin\gfrcMSvPbUA\*.*"
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.62202319844527922035723313175232017.class
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive568771924796615068.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive568771924796615068.vbs
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive728305422129664355.vbs
C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive728305422129664355.vbs
C:\Windows\SYSTEM32\cmd.exe
cmd.exe
C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM UserAccountControlSettings.exe /T /F
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\uWsxVHYpKC243382779161436191.reg
C:\Windows\regedit.exe
regedit.exe /s C:\Users\Admin\AppData\Local\Temp\uWsxVHYpKC243382779161436191.reg
Network
| Country | Destination | Domain | Proto |
| IE | 13.69.239.74:443 | tcp | |
| IE | 20.54.110.249:443 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| US | 8.8.8.8:53 | franmhort.duia.ro | udp |
| CH | 91.192.100.8:8153 | franmhort.duia.ro | tcp |
| US | 8.8.8.8:53 | datata.ddns.net | udp |
Files
memory/1604-136-0x0000000002BD0000-0x0000000003BD0000-memory.dmp
memory/1380-140-0x0000000000000000-mapping.dmp
C:\Users\Admin\slrtghxwgp.js
| MD5 | a0feff107f173acc9b411620b16cfddf |
| SHA1 | b7b5985ad225aef80e1e0e08297330f2257f7f59 |
| SHA256 | 100de96a9a0778b9d66d919de429cecb7ee54c4e3ddce9911d40a0ded003d185 |
| SHA512 | 99d7ca04f65e2cadd0678166a5b1c07e476873bd43c90290982731e3657bd43a4ddcfb57a1317381529eb50dd1dadd7e87273006f4179e43b4a3251184ed7000 |
memory/1328-143-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\xRKCVudFNp.js
| MD5 | 63649fb5e85e7f8c93a1ad99a27b7b22 |
| SHA1 | ae8e7a2215151a271d983e52ba8a56a77ae6baed |
| SHA256 | e5d86ad0a6d4aaf17667fc846727326d86608c9cbee572b6aef70c92b028d86d |
| SHA512 | 7bd802d530f5b752a8b9ec2e0e45ade04b70d0edf29b007852682e25cc3a63531fde3d2c57e03d5fb8478caeff823b028d9bd83ef693876d5f803868428d5f3a |
memory/4776-145-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\cyxnvzm.txt
| MD5 | e6e49d6575a99dc7eaf81091e02190b6 |
| SHA1 | d7abf421d1a9d080d89b2922003a0d869d64ac2c |
| SHA256 | 3df792e3ab0c1efd66231647b0369e5805d359403d5b534a2562a7ba301b0757 |
| SHA512 | 98743a430ab0490aed350a800d057dbaf7b29d2ce9833ca7cefc3e52a18dc5918c315918f64b193ca6d42f0250f7d93f001606689852de3f56182de42e0a7d3f |
C:\Users\Admin\AppData\Roaming\AsyncClient.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/2292-151-0x0000000000000000-mapping.dmp
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | 418895e250dd26ec3d3460f389a3cf2f |
| SHA1 | 74d78447c8577d6e5d2d76d80055f55b0cedc485 |
| SHA256 | 9fbd498b0f39b35a6799bd13171816dde7fce9ae26170ea51e2997232bb4088b |
| SHA512 | 309cf8d1afa32f73da6f8c30b7aaf3c731bc223e4a35ec9233bab775d314424111bf4587242f84884f2921238d4983599b159b8eac5d43c4845c07aae615434f |
memory/4776-159-0x0000000003350000-0x0000000004350000-memory.dmp
C:\Users\Admin\AppData\Roaming\AsyncClient.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/4504-161-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\_0.31762649914943015647649392174404845.class
| MD5 | 781fb531354d6f291f1ccab48da6d39f |
| SHA1 | 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68 |
| SHA256 | 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9 |
| SHA512 | 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8 |
memory/2292-165-0x0000000000310000-0x0000000000322000-memory.dmp
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | e8a1cd5c4961bd40858661f893f3d161 |
| SHA1 | a63d8abae496036a0deb9d10b0845ae1846430f4 |
| SHA256 | b83d1d729243dc8d42dd95b41c02c54e445c8183563d5ff2831b0b3d609eb220 |
| SHA512 | c29ecdbd54ddd3a82284c7f808bd5f4af422c7d64d8591ed19c8d69b3dd7d913853dbf1bdbaa4cf9da569d3c3e7dc3bf6c919a45ccbb8cdef16044901608c9ab |
memory/4504-173-0x00000000024D0000-0x00000000034D0000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3751123196-3323558407-1869646069-1000\83aa4cc77f591dfc2374580bbd95f6ba_6bb404a8-25bc-4cef-a831-797f8d1e89c0
| MD5 | c8366ae350e7019aefc9d1e6e6a498c6 |
| SHA1 | 5731d8a3e6568a5f2dfbbc87e3db9637df280b61 |
| SHA256 | 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238 |
| SHA512 | 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd |
memory/4776-179-0x0000000003350000-0x0000000004350000-memory.dmp
memory/4792-184-0x0000000000000000-mapping.dmp
memory/316-185-0x0000000000000000-mapping.dmp
memory/4776-186-0x0000000003350000-0x0000000004350000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive6407459440606450900.vbs
| MD5 | 3bdfd33017806b85949b6faa7d4b98e4 |
| SHA1 | f92844fee69ef98db6e68931adfaa9a0a0f8ce66 |
| SHA256 | 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6 |
| SHA512 | ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429 |
memory/4776-188-0x0000000003350000-0x0000000004350000-memory.dmp
memory/4776-189-0x0000000003350000-0x0000000004350000-memory.dmp
memory/3992-190-0x0000000000000000-mapping.dmp
memory/2292-191-0x0000000004CD0000-0x0000000004D6C000-memory.dmp
memory/4032-192-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive3698165362106108794.vbs
| MD5 | a32c109297ed1ca155598cd295c26611 |
| SHA1 | dc4a1fdbaad15ddd6fe22d3907c6b03727b71510 |
| SHA256 | 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7 |
| SHA512 | 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887 |
memory/404-194-0x0000000000000000-mapping.dmp
memory/3984-195-0x0000000000000000-mapping.dmp
memory/4788-196-0x0000000000000000-mapping.dmp
memory/3332-198-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\tmp3E8.tmp.bat
| MD5 | 2aef4f143d3fb97d85327d4a921fd162 |
| SHA1 | 263b63669626737c88bda9af93595140bf6687cd |
| SHA256 | e10b90f109322add648b5baadf3976cd7ed0591f3f5135016ea00e6d4c83201a |
| SHA512 | 8d54f600b38c7db779e1c56e4a610699874b6fb7830e5343eccf636c2d4112370815b39996e9832886e39174252fdf7180c0b57aa027253cf93c24fbf060ce90 |
memory/2248-200-0x0000000000000000-mapping.dmp
memory/4776-201-0x0000000003350000-0x0000000004350000-memory.dmp
memory/3176-202-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\win.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/2952-205-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\win.exe
| MD5 | cbdce3b5e2939fe92312004dcb31151f |
| SHA1 | 6f11f275c611decd4659f23a4593103f327806a6 |
| SHA256 | 6ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3 |
| SHA512 | 6240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8 |
memory/4776-206-0x0000000003350000-0x0000000004350000-memory.dmp
memory/4776-208-0x0000000003350000-0x0000000004350000-memory.dmp
memory/4776-209-0x0000000003350000-0x0000000004350000-memory.dmp
memory/1508-210-0x0000000000000000-mapping.dmp
memory/3036-213-0x0000000000000000-mapping.dmp
memory/1688-212-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
| MD5 | aa120c29e7202ce9ae9c0752284c7e36 |
| SHA1 | 94e7d33ccab298c67b1cc816d3c228cc7e6b84e4 |
| SHA256 | 449036069e2bfe7ec052a614be07ad7105a3203d974d46423c0c32d6ce888661 |
| SHA512 | 1442856f08213f4a356cd404c50a65a12b908f6fb86c299d636af595577ef8af82294ad4237fbb025578b946e8f179b9eed0f6d6c4aa88970bfb228ae8c767f8 |
memory/4356-211-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
| MD5 | ef745af1ddd4826d206f1942fa0e4b6f |
| SHA1 | 3260b76ca72e6ac80f8551d8fcba9926438cd838 |
| SHA256 | ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8 |
| SHA512 | cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb |
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll
| MD5 | df3ca8d16bded6a54977b30e66864d33 |
| SHA1 | b7b9349b33230c5b80886f5c1f0a42848661c883 |
| SHA256 | 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36 |
| SHA512 | 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
| MD5 | b140730c68a0d3e52d4533f4fb32dce8 |
| SHA1 | 82687e557c57534f1e54f14a016eaac0f375e83d |
| SHA256 | 88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943 |
| SHA512 | 9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe |
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
| MD5 | ce330d52fc60db54ddfb463ad2280722 |
| SHA1 | 9506dfdaf3db5636a45b6e06006670387c62746c |
| SHA256 | ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9 |
| SHA512 | 56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c |
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
| MD5 | ce330d52fc60db54ddfb463ad2280722 |
| SHA1 | 9506dfdaf3db5636a45b6e06006670387c62746c |
| SHA256 | ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9 |
| SHA512 | 56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c |
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
| MD5 | 91aa6ea7320140f30379f758d626e59d |
| SHA1 | 3be2febe28723b1033ccdaa110eaf59bbd6d1f96 |
| SHA256 | 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4 |
| SHA512 | 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb |
C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar
| MD5 | beeac7cd2752c61f972ad962dda48ee9 |
| SHA1 | 5c7f95f0a86ede676cd89dc9b69bb42eb01e1fbd |
| SHA256 | eada0b343fc16a14b70a40a6518a58aa3e921ae032f9865944aabfd093843813 |
| SHA512 | 24e1673fee6f37f510f029ccd98139993c902536ffc41545a2d6985b0198537e1e1b04e9f05d936334599f0fb07b80d32026fee4fcaa531a1786c2e607c4288f |
C:\Users\Admin\gfrcMSvPbUA\ID.txt
| MD5 | 85ca4def04c5f940e3a6ef22f25dee41 |
| SHA1 | 74e98e62e0836748e77d1eb6b0bce5ea4c48f8ea |
| SHA256 | 84d21ffe73240e008a1dcd89e67da446d84b3481af2f3f8406baf1bd7347b6eb |
| SHA512 | 12ccd14845dcbf9f1075c8ffabf1f1810c1f9889defe0927e273108832eb1a8f462dca23230cb94169f24687b1e696739aacb03f026e3082e8fae20c11fd19ec |
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
| MD5 | a56686411fc41f3abeea19f129935ee9 |
| SHA1 | 6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6 |
| SHA256 | 0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec |
| SHA512 | be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e |
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
| MD5 | a56686411fc41f3abeea19f129935ee9 |
| SHA1 | 6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6 |
| SHA256 | 0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec |
| SHA512 | be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e |
memory/4776-230-0x0000000003350000-0x0000000004350000-memory.dmp
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
| MD5 | b140730c68a0d3e52d4533f4fb32dce8 |
| SHA1 | 82687e557c57534f1e54f14a016eaac0f375e83d |
| SHA256 | 88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943 |
| SHA512 | 9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe |
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll
| MD5 | df3ca8d16bded6a54977b30e66864d33 |
| SHA1 | b7b9349b33230c5b80886f5c1f0a42848661c883 |
| SHA256 | 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36 |
| SHA512 | 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
| MD5 | 499f2a4e0a25a41c1ff80df2d073e4fd |
| SHA1 | e2469cbe07e92d817637be4e889ebb74c3c46253 |
| SHA256 | 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb |
| SHA512 | 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d |
C:\Users\Admin\gfrcMSvPbUA\fvadspBOUVV.yYgxrl
| MD5 | e6e49d6575a99dc7eaf81091e02190b6 |
| SHA1 | d7abf421d1a9d080d89b2922003a0d869d64ac2c |
| SHA256 | 3df792e3ab0c1efd66231647b0369e5805d359403d5b534a2562a7ba301b0757 |
| SHA512 | 98743a430ab0490aed350a800d057dbaf7b29d2ce9833ca7cefc3e52a18dc5918c315918f64b193ca6d42f0250f7d93f001606689852de3f56182de42e0a7d3f |
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
| MD5 | ef745af1ddd4826d206f1942fa0e4b6f |
| SHA1 | 3260b76ca72e6ac80f8551d8fcba9926438cd838 |
| SHA256 | ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8 |
| SHA512 | cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb |
memory/4776-240-0x0000000003350000-0x0000000004350000-memory.dmp
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index
| MD5 | 005faac2118450bfcd46ae414da5f0e5 |
| SHA1 | 9f5c887e0505e1bb06bd1fc7975a3219709d061d |
| SHA256 | f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8 |
| SHA512 | 8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security
| MD5 | d81c4d59c02c525dba1398235dc278c9 |
| SHA1 | f71af6018024dfef946910e95151190e95d08c59 |
| SHA256 | 4466d783bffeee009e3ca12a8e6c6318ff622408fc50dfc9ae529830dece56b3 |
| SHA512 | 4551d2959adced83d7024f813941b12fd0239a4c5bdffdf2a9e78b9e08a1163e045317dbb91097c2ef9c0a5de556b44ca1b201b1c9fe23cb977e2daac29bb276 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
| MD5 | e4263de270b7e77aff4aa979d856e9f4 |
| SHA1 | 550b1f9a5eefdebc3474f72d6eca3567edf160e9 |
| SHA256 | 87d5757d5858b8db77b8b48b74bcc1b7abb953cf4eca404326b355954511e563 |
| SHA512 | e3cdd4f9c3f07a7f7540c7ef6069452021c71a9bc1ac25d4fb4042855dfb0767c6163bc832f8770b150cec8cf3f4476cfff545339b83b19f94d09a3b077163a0 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
| MD5 | 86588a13a4acb85da6aaea8ec495205c |
| SHA1 | 07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95 |
| SHA256 | b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63 |
| SHA512 | 7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
| MD5 | 86588a13a4acb85da6aaea8ec495205c |
| SHA1 | 07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95 |
| SHA256 | b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63 |
| SHA512 | 7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
| MD5 | 7a04210ba8c986ea53b4f4f685cf9c42 |
| SHA1 | 90ee52ad6ac4565977c05999240696587bfff955 |
| SHA256 | e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6 |
| SHA512 | ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c |
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
| MD5 | 7a04210ba8c986ea53b4f4f685cf9c42 |
| SHA1 | 90ee52ad6ac4565977c05999240696587bfff955 |
| SHA256 | e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6 |
| SHA512 | ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c |
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
| MD5 | faf8c06436a9ce2c2e27d83a2639319d |
| SHA1 | 94c62a85b019936658627ad916c1477f6a1c6df9 |
| SHA256 | 2713dfebcf17ecd17c6d21104846bc14fe1c8d4981de886d1cc2d194c7dfcf4b |
| SHA512 | 9ac580ad17ed2aae97001cd137e3686e7c97e7e97ed820b3f4c886419d54d067441f3a85711fc9b24c9ce0c4895c483693c1fb8f2eb369a7f3ef52b0642b1bb2 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
| MD5 | 93070881a5c582e0147b0b71cf64fc85 |
| SHA1 | 58b95b2da2ea5a049b31647cdcd59539ae1240a4 |
| SHA256 | 72ed3462f55fc833e2b753b70e1ef5268c189490f5a41aa716cc9a6596455907 |
| SHA512 | cde37e5e79afeac2aacb9e4059224bec32223a20bd7dc0562ce9617dfdd9072a238553e92fce73eec0e562ae0b685ee3717b1ec5f7c1bb17bea10ec596a58169 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar
| MD5 | a269905bbb9f7d02baa24a756e7b09d7 |
| SHA1 | 82a0f9c5cbc2b79bdb6cfe80487691e232b26f9c |
| SHA256 | e2787698d746dc25c24d3be0fa751cea6267f68b4e972cfc3df4b4eac8046245 |
| SHA512 | 496841cf49e2bf4eb146632f7d1f09efa8f38ae99b93081af4297a7d8412b444b9f066358f0c110d33fea6ae60458355271d8fdcd9854c02efb2023af5f661f6 |
memory/1944-248-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
| MD5 | 89ab2a94e87122dffec8dfc347615cc0 |
| SHA1 | 1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e |
| SHA256 | f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e |
| SHA512 | 0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e |
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\US_export_policy.jar
| MD5 | ee4ed9c75a1aaa04dfd192382c57900c |
| SHA1 | 7d69ea3b385bc067738520f1b5c549e1084be285 |
| SHA256 | 90012f900cf749a0e52a0775966ef575d390ad46388c49d512838983a554a870 |
| SHA512 | eae6a23d2fd7002a55465844e662d7a5e3ed5a6a8baf7317897e59a92a4b806dd26f2a19b7c05984745050b4fe3ffa30646a19c0f08451440e415f958204137c |
C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll
| MD5 | df3ca8d16bded6a54977b30e66864d33 |
| SHA1 | b7b9349b33230c5b80886f5c1f0a42848661c883 |
| SHA256 | 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36 |
| SHA512 | 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
| MD5 | ef745af1ddd4826d206f1942fa0e4b6f |
| SHA1 | 3260b76ca72e6ac80f8551d8fcba9926438cd838 |
| SHA256 | ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8 |
| SHA512 | cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb |
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\local_policy.jar
| MD5 | 57aaaa3176dc28fc554ef0906d01041a |
| SHA1 | 238b8826e110f58acb2e1959773b0a577cd4d569 |
| SHA256 | b8becc3ef2e7ff7d2165dd1a4e13b9c59fd626f20a26af9a32277c1f4b5d5bc7 |
| SHA512 | 8704b5e3665f28d1a0bc2a063f4bc07ba3c7cd8611e06c0d636a91d5ea55f63e85c6d2ad49e5d8ece267d43ca3800b3cd09cf369841c94d30692eb715bb0098e |
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
| MD5 | ce330d52fc60db54ddfb463ad2280722 |
| SHA1 | 9506dfdaf3db5636a45b6e06006670387c62746c |
| SHA256 | ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9 |
| SHA512 | 56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c |
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
| MD5 | a56686411fc41f3abeea19f129935ee9 |
| SHA1 | 6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6 |
| SHA256 | 0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec |
| SHA512 | be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e |
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs
| MD5 | 91c7195d1abf0081758ce00c8248732c |
| SHA1 | 9f8852ffcba434070e23dc2e1f22b3b284ba8854 |
| SHA256 | a8e6daf874fa9854c80eb6aba7b4d327b641f74d95033adc2a80c6d6d0ba26e2 |
| SHA512 | c1d464158aa86c622becb197c0f95c9d2b24d5e9cd38707ae47e6d7b2f614cb1f99f146c9288e1e93c6b103b0e78471544ca1b08bb08d24bfde758e894626377 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
| MD5 | b140730c68a0d3e52d4533f4fb32dce8 |
| SHA1 | 82687e557c57534f1e54f14a016eaac0f375e83d |
| SHA256 | 88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943 |
| SHA512 | 9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe |
C:\Users\Admin\AppData\Local\Temp\_0.62202319844527922035723313175232017.class
| MD5 | 781fb531354d6f291f1ccab48da6d39f |
| SHA1 | 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68 |
| SHA256 | 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9 |
| SHA512 | 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
| MD5 | 2c8eb358076f9af81048f0295ecd1e8d |
| SHA1 | 29820464260229b133c39965832ec39ba1b5e363 |
| SHA256 | 3acb15d471dc1749e28be6cbff6c16dd4d81eeb7f5d89e61f4964ee3b570cbc4 |
| SHA512 | 5028f26b40451c395543a1d4096c8ee12075bd44bf7dadc9321c84fa77190e0afee8e9882ef45b78aa1bb2d10af383ec4e5881e2a51216b5f20eb994c243d673 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
| MD5 | 89ab2a94e87122dffec8dfc347615cc0 |
| SHA1 | 1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e |
| SHA256 | f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e |
| SHA512 | 0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e |
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
| MD5 | 34b24a98bd43143f16fa0bca098c9a47 |
| SHA1 | 40c306107ee9e284c89d92ce40d4abe511c202f8 |
| SHA256 | d9d8328c652819cba0a9f332aa65d2ed86f08ab8c2dc55353ac640cd687fad4b |
| SHA512 | e8e330f60d3d7ef1e79988117ea06a0dbb69aad3a19c8c08e2473fe8b64b041375a719d4605cfc3e50567a0413d58ed52c3caf6d0b971c8cae3878fbade35295 |
C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties
| MD5 | 2ed483df31645d3d00c625c00c1e5a14 |
| SHA1 | 27c9b302d2d47aae04fc1f4ef9127a2835a77853 |
| SHA256 | 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf |
| SHA512 | 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da |
memory/3036-272-0x0000000002CB0000-0x0000000003CB0000-memory.dmp
C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
| MD5 | 68930e83a010c461b783ab4a1d043932 |
| SHA1 | 3f9c4e63dc60de5b7d5b872ac89d864fafab159b |
| SHA256 | 3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b |
| SHA512 | 458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
| MD5 | 68930e83a010c461b783ab4a1d043932 |
| SHA1 | 3f9c4e63dc60de5b7d5b872ac89d864fafab159b |
| SHA256 | 3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b |
| SHA512 | 458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886 |
C:\Users\Admin\.oracle_jre_usage\50569f7db71fa7f8.timestamp
| MD5 | 21184570fdbef8ce4f935078df9b8f2c |
| SHA1 | 6bf4ae42e7ce20f678aec9b6eda43c5f90124767 |
| SHA256 | bbb4096985cc834735113f19273b11c5c5144646360bdee5ea3b56f3cfab313e |
| SHA512 | 0c78bdca35aa331972c8c473c90d0cfc63bd53107e503dfab1bf447b8fe61efa387f7003a47af3930b348f317be398b682e9701fa694df81fdace23457b75e72 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
| MD5 | 89ab2a94e87122dffec8dfc347615cc0 |
| SHA1 | 1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e |
| SHA256 | f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e |
| SHA512 | 0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e |
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
| MD5 | 86588a13a4acb85da6aaea8ec495205c |
| SHA1 | 07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95 |
| SHA256 | b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63 |
| SHA512 | 7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181 |
memory/1944-284-0x00000000027C0000-0x00000000037C0000-memory.dmp
memory/2260-286-0x0000000000000000-mapping.dmp
memory/3036-287-0x0000000002CB0000-0x0000000003CB0000-memory.dmp
memory/3120-288-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive568771924796615068.vbs
| MD5 | 3bdfd33017806b85949b6faa7d4b98e4 |
| SHA1 | f92844fee69ef98db6e68931adfaa9a0a0f8ce66 |
| SHA256 | 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6 |
| SHA512 | ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429 |
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
| MD5 | 7a04210ba8c986ea53b4f4f685cf9c42 |
| SHA1 | 90ee52ad6ac4565977c05999240696587bfff955 |
| SHA256 | e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6 |
| SHA512 | ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c |
memory/1880-294-0x0000000000000000-mapping.dmp
memory/4844-295-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Retrive728305422129664355.vbs
| MD5 | a32c109297ed1ca155598cd295c26611 |
| SHA1 | dc4a1fdbaad15ddd6fe22d3907c6b03727b71510 |
| SHA256 | 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7 |
| SHA512 | 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887 |
memory/4856-299-0x0000000000000000-mapping.dmp
C:\Windows\System32\test.txt
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll
| MD5 | 3bce03cc24cb8e4a36c6beb71d98e850 |
| SHA1 | 2c0423efd5a3dcd54ac8d9805c0ca0aace2f2097 |
| SHA256 | f54990046c77bc5a62f06969ad78039b19c4681d09f4ab1c5112de5a87433631 |
| SHA512 | 2a20899efb6d8417c9312c578f1d519cb21559a162b839ec2db7a6e81de99c025d1dbcbdbc330a078e5acb4a53ecdf514e7ba7444b18fa9ce7b8da6cfd0e4253 |
memory/3036-301-0x0000000002CB0000-0x0000000003CB0000-memory.dmp
memory/3036-302-0x0000000002CB0000-0x0000000003CB0000-memory.dmp
memory/3036-303-0x0000000002CB0000-0x0000000003CB0000-memory.dmp
memory/4996-305-0x0000000000000000-mapping.dmp
memory/4400-307-0x0000000000000000-mapping.dmp
memory/3924-308-0x0000000000000000-mapping.dmp