Malware Analysis Report

2024-12-07 21:05

Sample ID 220825-m188hscgh4
Target xB0 2022000622.jar
SHA256 018f9f07e9a997c88dabdc3d15e8332ac7cdcb73bd35a45929ed4631fd2ce2ae
Tags
adwind trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

018f9f07e9a997c88dabdc3d15e8332ac7cdcb73bd35a45929ed4631fd2ce2ae

Threat Level: Known bad

The file xB0 2022000622.jar was found to be: Known bad.

Malicious Activity Summary

adwind trojan persistence

AdWind

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Views/modifies file attributes

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-08-25 10:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-25 10:57

Reported

2022-08-25 10:59

Platform

win7-20220812-en

Max time kernel

147s

Max time network

48s

Command Line

java -jar "C:\Users\Admin\AppData\Local\Temp\xB0 2022000622.jar"

Signatures

AdWind

trojan adwind

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\test.txt C:\Program Files\Java\jre7\bin\java.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre7\bin\java.exe N/A
N/A N/A C:\Program Files\Java\jre7\bin\javaw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 1416 N/A C:\Windows\system32\java.exe C:\Windows\system32\wscript.exe
PID 1972 wrote to memory of 1416 N/A C:\Windows\system32\java.exe C:\Windows\system32\wscript.exe
PID 1972 wrote to memory of 1416 N/A C:\Windows\system32\java.exe C:\Windows\system32\wscript.exe
PID 1416 wrote to memory of 892 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WScript.exe
PID 1416 wrote to memory of 892 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WScript.exe
PID 1416 wrote to memory of 892 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\WScript.exe
PID 1416 wrote to memory of 1788 N/A C:\Windows\system32\wscript.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1416 wrote to memory of 1788 N/A C:\Windows\system32\wscript.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1416 wrote to memory of 1788 N/A C:\Windows\system32\wscript.exe C:\Program Files\Java\jre7\bin\javaw.exe
PID 1788 wrote to memory of 1956 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1788 wrote to memory of 1956 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1788 wrote to memory of 1956 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Program Files\Java\jre7\bin\java.exe
PID 1956 wrote to memory of 1040 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 1040 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 1040 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 108 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 108 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 108 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 1052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1040 wrote to memory of 1052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1040 wrote to memory of 1052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 108 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 108 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 108 wrote to memory of 2032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1788 wrote to memory of 1944 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1944 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 1944 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 936 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 936 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 936 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1944 wrote to memory of 2040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1944 wrote to memory of 2040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1944 wrote to memory of 2040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 936 wrote to memory of 820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 936 wrote to memory of 820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 936 wrote to memory of 820 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cscript.exe
PID 1956 wrote to memory of 1916 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1956 wrote to memory of 1916 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1956 wrote to memory of 1916 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\xcopy.exe
PID 1788 wrote to memory of 892 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\xcopy.exe
PID 1788 wrote to memory of 892 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\xcopy.exe
PID 1788 wrote to memory of 892 N/A C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\system32\xcopy.exe
PID 1956 wrote to memory of 1348 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 1348 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 1348 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe

Processes

C:\Windows\system32\java.exe

java -jar "C:\Users\Admin\AppData\Local\Temp\xB0 2022000622.jar"

C:\Windows\system32\wscript.exe

wscript C:\Users\Admin\xzkekuvpqa.js

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\NyRSpZnNCB.js"

C:\Program Files\Java\jre7\bin\javaw.exe

"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bgoepvdsve.txt"

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.95868493717101974212073251847545535.class

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4940840027912491190.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3217596787213611826.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4940840027912491190.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3217596787213611826.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2773721042635586923.vbs

C:\Windows\system32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1693241130788594893.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1693241130788594893.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2773721042635586923.vbs

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

C:\Windows\system32\xcopy.exe

xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

C:\Windows\system32\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 204.79.197.200:443 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp
N/A 127.0.0.1:7777 tcp

Files

memory/1972-54-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

memory/1416-64-0x0000000000000000-mapping.dmp

memory/1972-66-0x00000000021E0000-0x00000000051E0000-memory.dmp

C:\Users\Admin\xzkekuvpqa.js

MD5 a54ae3e83accf4573e5f566364e52ea0
SHA1 581208061d0df7dc409fe4d1217407b46a4a417f
SHA256 ab6bfa3dc65e89dba54203f2520f0d1508ce8a898909f95691fb0d9d769b9a1d
SHA512 c48f67e891eab10e53da37a680c40de3d165b41bddfa37f21ee257578e0dd1326d20208616ef60a7dfdce077ce8e1bf1a5906c9428ba405afc82da7db60430ac

memory/892-69-0x0000000000000000-mapping.dmp

memory/1788-71-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\NyRSpZnNCB.js

MD5 b9d39af61c76b1293ded1801442abd78
SHA1 076ac05e971a9e58a3ae025cbb3c321bc834609b
SHA256 981db32077ddd37fde8bb871c928bcfce6aeee3b21443ce78da51dd8e81ec46d
SHA512 1ec271a8f7153a395de705be248d7977775690550c4da63a74c49372098a34bfb453b4f2c1980c8c5cab56ace0a6c98977b691b3c00a7f2837108e74bd158139

C:\Users\Admin\AppData\Roaming\bgoepvdsve.txt

MD5 e830b7dfd0056c301fbc558bcc6f82e6
SHA1 396ee374edf10aac43db7fdd9475dc45a8b4d26e
SHA256 663e38a1e005ef7b5a14d314ef45618bd165e1588fc1249cdd2baaa1858a8967
SHA512 dbd53826eb5fd91f7ffa73f0d67363061ecdf8ba5004d20d84222d98142f9e57fc4c501193e917a8d03393081dd26a4b410edfc191f46ee8afd4c4333287aba2

memory/1788-83-0x0000000002060000-0x0000000005060000-memory.dmp

memory/1956-84-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.95868493717101974212073251847545535.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

memory/1956-96-0x0000000002050000-0x0000000005050000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2591564548-2301609547-1748242483-1000\83aa4cc77f591dfc2374580bbd95f6ba_cea0eab3-c223-4f79-bf84-9af11aecddbc

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/1040-99-0x0000000000000000-mapping.dmp

memory/108-100-0x0000000000000000-mapping.dmp

memory/1052-101-0x0000000000000000-mapping.dmp

memory/2032-102-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive3217596787213611826.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

C:\Users\Admin\AppData\Local\Temp\Retrive4940840027912491190.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/1944-105-0x0000000000000000-mapping.dmp

memory/936-106-0x0000000000000000-mapping.dmp

memory/2040-107-0x0000000000000000-mapping.dmp

memory/820-108-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive2773721042635586923.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

C:\Users\Admin\AppData\Local\Temp\Retrive1693241130788594893.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/1916-111-0x0000000000000000-mapping.dmp

memory/892-112-0x0000000000000000-mapping.dmp

memory/1972-113-0x00000000021E0000-0x00000000051E0000-memory.dmp

memory/1788-114-0x0000000002060000-0x0000000005060000-memory.dmp

memory/1348-115-0x0000000000000000-mapping.dmp

memory/1956-116-0x0000000002050000-0x0000000005050000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-08-25 10:57

Reported

2022-08-25 10:59

Platform

win10v2004-20220812-en

Max time kernel

113s

Max time network

155s

Command Line

java -jar "C:\Users\Admin\AppData\Local\Temp\xB0 2022000622.jar"

Signatures

AdWind

trojan adwind

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Windows\SYSTEM32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lMpweJSGDjr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\JVlpBjOuqsQ\\.jar.Bttolj\"" C:\Windows\SYSTEM32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SYSTEM32\reg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\test.txt C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb C:\Program Files\Java\jre1.8.0_66\bin\java.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings C:\Windows\SYSTEM32\wscript.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\reg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4376 wrote to memory of 4360 N/A C:\ProgramData\Oracle\Java\javapath\java.exe C:\Windows\SYSTEM32\wscript.exe
PID 4376 wrote to memory of 4360 N/A C:\ProgramData\Oracle\Java\javapath\java.exe C:\Windows\SYSTEM32\wscript.exe
PID 4360 wrote to memory of 2664 N/A C:\Windows\SYSTEM32\wscript.exe C:\Windows\System32\WScript.exe
PID 4360 wrote to memory of 2664 N/A C:\Windows\SYSTEM32\wscript.exe C:\Windows\System32\WScript.exe
PID 4360 wrote to memory of 2376 N/A C:\Windows\SYSTEM32\wscript.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 4360 wrote to memory of 2376 N/A C:\Windows\SYSTEM32\wscript.exe C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
PID 2376 wrote to memory of 4112 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe
PID 2376 wrote to memory of 4112 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Program Files\Java\jre1.8.0_66\bin\java.exe
PID 2376 wrote to memory of 4224 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2376 wrote to memory of 4224 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4224 wrote to memory of 3868 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 4224 wrote to memory of 3868 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 2376 wrote to memory of 1904 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2376 wrote to memory of 1904 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 1904 wrote to memory of 4532 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 1904 wrote to memory of 4532 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 2376 wrote to memory of 4484 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\xcopy.exe
PID 2376 wrote to memory of 4484 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\xcopy.exe
PID 2376 wrote to memory of 4888 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2376 wrote to memory of 4888 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2376 wrote to memory of 1440 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\reg.exe
PID 2376 wrote to memory of 1440 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\reg.exe
PID 2376 wrote to memory of 3592 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\attrib.exe
PID 2376 wrote to memory of 3592 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\attrib.exe
PID 2376 wrote to memory of 1080 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\attrib.exe
PID 2376 wrote to memory of 1080 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\SYSTEM32\attrib.exe
PID 2376 wrote to memory of 4640 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
PID 2376 wrote to memory of 4640 N/A C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
PID 4640 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
PID 4640 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
PID 4640 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4640 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4048 wrote to memory of 1072 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 4048 wrote to memory of 1072 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 4640 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 4640 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 2380 wrote to memory of 4344 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe
PID 2380 wrote to memory of 4344 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\cscript.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\ProgramData\Oracle\Java\javapath\java.exe

java -jar "C:\Users\Admin\AppData\Local\Temp\xB0 2022000622.jar"

C:\Windows\SYSTEM32\wscript.exe

wscript C:\Users\Admin\xzkekuvpqa.js

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\NyRSpZnNCB.js"

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\zbdnniakb.txt"

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.32770109517707384498561852400859455.class

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7097932813064527493.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7097932813064527493.vbs

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6664878029901765585.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6664878029901765585.vbs

C:\Windows\SYSTEM32\xcopy.exe

xcopy "C:\Program Files\Java\jre1.8.0_66" "C:\Users\Admin\AppData\Roaming\Oracle\" /e

C:\Windows\SYSTEM32\cmd.exe

cmd.exe

C:\Windows\SYSTEM32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v lMpweJSGDjr /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\JVlpBjOuqsQ\.jar.Bttolj\"" /f

C:\Windows\SYSTEM32\attrib.exe

attrib +h "C:\Users\Admin\JVlpBjOuqsQ\*.*"

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\JVlpBjOuqsQ\.jar.Bttolj

C:\Windows\SYSTEM32\attrib.exe

attrib +h "C:\Users\Admin\JVlpBjOuqsQ"

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.242611891687519184200809929395376011.class

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1543179040232507171.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1543179040232507171.vbs

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4833113266882752586.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4833113266882752586.vbs

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6470091634773774970.vbs

C:\Windows\SYSTEM32\cmd.exe

cmd.exe

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6470091634773774970.vbs

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5694869614002335315.vbs

C:\Windows\system32\cscript.exe

cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5694869614002335315.vbs

C:\Windows\SYSTEM32\cmd.exe

cmd.exe

Network

Country Destination Domain Proto
NL 178.79.208.1:80 tcp
NL 52.178.17.3:443 tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
US 8.8.8.8:53 0b3c.duckdns.org udp

Files

memory/4376-136-0x0000000003150000-0x0000000004150000-memory.dmp

memory/4360-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\xzkekuvpqa.js

MD5 a54ae3e83accf4573e5f566364e52ea0
SHA1 581208061d0df7dc409fe4d1217407b46a4a417f
SHA256 ab6bfa3dc65e89dba54203f2520f0d1508ce8a898909f95691fb0d9d769b9a1d
SHA512 c48f67e891eab10e53da37a680c40de3d165b41bddfa37f21ee257578e0dd1326d20208616ef60a7dfdce077ce8e1bf1a5906c9428ba405afc82da7db60430ac

memory/2664-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\NyRSpZnNCB.js

MD5 b9d39af61c76b1293ded1801442abd78
SHA1 076ac05e971a9e58a3ae025cbb3c321bc834609b
SHA256 981db32077ddd37fde8bb871c928bcfce6aeee3b21443ce78da51dd8e81ec46d
SHA512 1ec271a8f7153a395de705be248d7977775690550c4da63a74c49372098a34bfb453b4f2c1980c8c5cab56ace0a6c98977b691b3c00a7f2837108e74bd158139

memory/2376-147-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\zbdnniakb.txt

MD5 e830b7dfd0056c301fbc558bcc6f82e6
SHA1 396ee374edf10aac43db7fdd9475dc45a8b4d26e
SHA256 663e38a1e005ef7b5a14d314ef45618bd165e1588fc1249cdd2baaa1858a8967
SHA512 dbd53826eb5fd91f7ffa73f0d67363061ecdf8ba5004d20d84222d98142f9e57fc4c501193e917a8d03393081dd26a4b410edfc191f46ee8afd4c4333287aba2

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 0ac493e336350ad02ce1121f1ffed1bc
SHA1 4580e38ff2e3e55b394494d75c7ab4d6aeea5290
SHA256 57dd927468bae3b4a83cb41f7f16fb28a38001a06fab502daa66478532b7a98e
SHA512 4ab4fd147a35ced1497733498620bd3663baf3435145baeae3946ed4ebbdee887a6d995ce9eea31cf54e0d1f83e22ba0d6c531a9e6018007548d466f458eb8e0

memory/2376-159-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/4112-160-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_0.32770109517707384498561852400859455.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 32b827efac4a089888a7afdb1707d1fd
SHA1 f31e8b04c0fa870f748afb8749522dacd9750cd1
SHA256 b69c4ad01e9b72073cce1413c46cac26451b01e232689bd7afd7fd7bd1e0c434
SHA512 6dfab08e01422ec1f88046f9409e87287c18dad04239824d71fdc7c53a73e9394abde3516bfbdc8809cdb969f1e07fe09b6af63d2640c9e40edaf2e28e7c1523

memory/4112-171-0x0000000003400000-0x0000000004400000-memory.dmp

memory/2376-172-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/4112-173-0x0000000003400000-0x0000000004400000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\83aa4cc77f591dfc2374580bbd95f6ba_e32e1c79-b88e-4709-94fb-81034ca3398e

MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

memory/4224-181-0x0000000000000000-mapping.dmp

memory/3868-182-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive7097932813064527493.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/1904-184-0x0000000000000000-mapping.dmp

memory/4532-185-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive6664878029901765585.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/4484-187-0x0000000000000000-mapping.dmp

memory/2376-189-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/2376-190-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/2376-191-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/4888-192-0x0000000000000000-mapping.dmp

memory/2376-194-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/1440-195-0x0000000000000000-mapping.dmp

memory/2376-196-0x00000000030C0000-0x00000000040C0000-memory.dmp

memory/1080-198-0x0000000000000000-mapping.dmp

memory/3592-197-0x0000000000000000-mapping.dmp

memory/4640-199-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

MD5 aa120c29e7202ce9ae9c0752284c7e36
SHA1 94e7d33ccab298c67b1cc816d3c228cc7e6b84e4
SHA256 449036069e2bfe7ec052a614be07ad7105a3203d974d46423c0c32d6ce888661
SHA512 1442856f08213f4a356cd404c50a65a12b908f6fb86c299d636af595577ef8af82294ad4237fbb025578b946e8f179b9eed0f6d6c4aa88970bfb228ae8c767f8

C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

MD5 ef745af1ddd4826d206f1942fa0e4b6f
SHA1 3260b76ca72e6ac80f8551d8fcba9926438cd838
SHA256 ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8
SHA512 cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb

C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

MD5 ef745af1ddd4826d206f1942fa0e4b6f
SHA1 3260b76ca72e6ac80f8551d8fcba9926438cd838
SHA256 ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8
SHA512 cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb

C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ce330d52fc60db54ddfb463ad2280722
SHA1 9506dfdaf3db5636a45b6e06006670387c62746c
SHA256 ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9
SHA512 56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c

C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

MD5 91aa6ea7320140f30379f758d626e59d
SHA1 3be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
SHA512 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

MD5 a56686411fc41f3abeea19f129935ee9
SHA1 6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6
SHA256 0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec
SHA512 be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e

C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

MD5 a56686411fc41f3abeea19f129935ee9
SHA1 6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6
SHA256 0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec
SHA512 be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ce330d52fc60db54ddfb463ad2280722
SHA1 9506dfdaf3db5636a45b6e06006670387c62746c
SHA256 ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9
SHA512 56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c

C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

MD5 b140730c68a0d3e52d4533f4fb32dce8
SHA1 82687e557c57534f1e54f14a016eaac0f375e83d
SHA256 88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943
SHA512 9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe

C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

MD5 b140730c68a0d3e52d4533f4fb32dce8
SHA1 82687e557c57534f1e54f14a016eaac0f375e83d
SHA256 88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943
SHA512 9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe

C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

MD5 499f2a4e0a25a41c1ff80df2d073e4fd
SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

C:\Users\Admin\JVlpBjOuqsQ\.jar.Bttolj

MD5 e830b7dfd0056c301fbc558bcc6f82e6
SHA1 396ee374edf10aac43db7fdd9475dc45a8b4d26e
SHA256 663e38a1e005ef7b5a14d314ef45618bd165e1588fc1249cdd2baaa1858a8967
SHA512 dbd53826eb5fd91f7ffa73f0d67363061ecdf8ba5004d20d84222d98142f9e57fc4c501193e917a8d03393081dd26a4b410edfc191f46ee8afd4c4333287aba2

C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar

MD5 e590e2382f3b255f1f0d1bccac903a4c
SHA1 8bee386ea8754e8280d76145dd9ce530a1ee3f56
SHA256 4528de2bab92a64877eab990133d692b91390f2d021950cfca45df42c4798369
SHA512 dd38d8eea0cc1fc029c1c284267bf59a091b54c6965361b3a8e78997739794fd768e0c9adb46d6ea1e39f059f770e0f3aecc814f8bee2e3987ff7a6b06b76438

C:\Users\Admin\JVlpBjOuqsQ\ID.txt

MD5 2b09d5087487edcbb3cf237fa90d61b8
SHA1 41ab7ed57a1574c07790eb4a2bfb965bfe73ca76
SHA256 ced83f542328d2ecd74d22ba2d29d4bbd32dabfd33de933af189fe78d4beac17
SHA512 b4bc4f51338a29ef5945a348002e08cd21730bff71ac48afe09c4fd9a024e07bc08012188fbfb5b19f76e55db096c77e2ecf8c22f4557edfa3a0c4c7d1f1090e

C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index

MD5 005faac2118450bfcd46ae414da5f0e5
SHA1 9f5c887e0505e1bb06bd1fc7975a3219709d061d
SHA256 f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8
SHA512 8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9

memory/4640-225-0x0000000002890000-0x0000000003890000-memory.dmp

C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar

MD5 e4263de270b7e77aff4aa979d856e9f4
SHA1 550b1f9a5eefdebc3474f72d6eca3567edf160e9
SHA256 87d5757d5858b8db77b8b48b74bcc1b7abb953cf4eca404326b355954511e563
SHA512 e3cdd4f9c3f07a7f7540c7ef6069452021c71a9bc1ac25d4fb4042855dfb0767c6163bc832f8770b150cec8cf3f4476cfff545339b83b19f94d09a3b077163a0

C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security

MD5 d81c4d59c02c525dba1398235dc278c9
SHA1 f71af6018024dfef946910e95151190e95d08c59
SHA256 4466d783bffeee009e3ca12a8e6c6318ff622408fc50dfc9ae529830dece56b3
SHA512 4551d2959adced83d7024f813941b12fd0239a4c5bdffdf2a9e78b9e08a1163e045317dbb91097c2ef9c0a5de556b44ca1b201b1c9fe23cb977e2daac29bb276

memory/4640-230-0x0000000002890000-0x0000000003890000-memory.dmp

C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

MD5 86588a13a4acb85da6aaea8ec495205c
SHA1 07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95
SHA256 b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63
SHA512 7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181

C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

MD5 7a04210ba8c986ea53b4f4f685cf9c42
SHA1 90ee52ad6ac4565977c05999240696587bfff955
SHA256 e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6
SHA512 ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c

C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

MD5 86588a13a4acb85da6aaea8ec495205c
SHA1 07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95
SHA256 b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63
SHA512 7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181

C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

MD5 7a04210ba8c986ea53b4f4f685cf9c42
SHA1 90ee52ad6ac4565977c05999240696587bfff955
SHA256 e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6
SHA512 ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c

memory/3156-234-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

MD5 faf8c06436a9ce2c2e27d83a2639319d
SHA1 94c62a85b019936658627ad916c1477f6a1c6df9
SHA256 2713dfebcf17ecd17c6d21104846bc14fe1c8d4981de886d1cc2d194c7dfcf4b
SHA512 9ac580ad17ed2aae97001cd137e3686e7c97e7e97ed820b3f4c886419d54d067441f3a85711fc9b24c9ce0c4895c483693c1fb8f2eb369a7f3ef52b0642b1bb2

C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar

MD5 93070881a5c582e0147b0b71cf64fc85
SHA1 58b95b2da2ea5a049b31647cdcd59539ae1240a4
SHA256 72ed3462f55fc833e2b753b70e1ef5268c189490f5a41aa716cc9a6596455907
SHA512 cde37e5e79afeac2aacb9e4059224bec32223a20bd7dc0562ce9617dfdd9072a238553e92fce73eec0e562ae0b685ee3717b1ec5f7c1bb17bea10ec596a58169

C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar

MD5 a269905bbb9f7d02baa24a756e7b09d7
SHA1 82a0f9c5cbc2b79bdb6cfe80487691e232b26f9c
SHA256 e2787698d746dc25c24d3be0fa751cea6267f68b4e972cfc3df4b4eac8046245
SHA512 496841cf49e2bf4eb146632f7d1f09efa8f38ae99b93081af4297a7d8412b444b9f066358f0c110d33fea6ae60458355271d8fdcd9854c02efb2023af5f661f6

C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

MD5 89ab2a94e87122dffec8dfc347615cc0
SHA1 1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e
SHA256 f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e
SHA512 0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e

C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar

MD5 2c8eb358076f9af81048f0295ecd1e8d
SHA1 29820464260229b133c39965832ec39ba1b5e363
SHA256 3acb15d471dc1749e28be6cbff6c16dd4d81eeb7f5d89e61f4964ee3b570cbc4
SHA512 5028f26b40451c395543a1d4096c8ee12075bd44bf7dadc9321c84fa77190e0afee8e9882ef45b78aa1bb2d10af383ec4e5881e2a51216b5f20eb994c243d673

C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

MD5 ef745af1ddd4826d206f1942fa0e4b6f
SHA1 3260b76ca72e6ac80f8551d8fcba9926438cd838
SHA256 ff71a50534d0849b810b20c9403300aba6df4ee09fa00127c95f67c1c51f18d8
SHA512 cad9b9bd1f381b4b05d404ee1809db6737498a362c74d196104c647d0b66cde80554957ece14147c2a850a4245020052ac2c1ad4949eed72273a1e6f8a7261eb

C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcr100.dll

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Users\Admin\AppData\Local\Temp\_0.242611891687519184200809929395376011.class

MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

MD5 89ab2a94e87122dffec8dfc347615cc0
SHA1 1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e
SHA256 f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e
SHA512 0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e

C:\Users\Admin\AppData\Roaming\Oracle\lib\security\US_export_policy.jar

MD5 ee4ed9c75a1aaa04dfd192382c57900c
SHA1 7d69ea3b385bc067738520f1b5c549e1084be285
SHA256 90012f900cf749a0e52a0775966ef575d390ad46388c49d512838983a554a870
SHA512 eae6a23d2fd7002a55465844e662d7a5e3ed5a6a8baf7317897e59a92a4b806dd26f2a19b7c05984745050b4fe3ffa30646a19c0f08451440e415f958204137c

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

MD5 ce330d52fc60db54ddfb463ad2280722
SHA1 9506dfdaf3db5636a45b6e06006670387c62746c
SHA256 ec55bc29ddec5cfbe53cb366b6d1ce5011323f48b8411f22e27ba8dfe7cfbea9
SHA512 56e4cb6d55b166fbcaa2feeaa80b230f109cedadba2af0d7dfef80ae6289a49c00515f4d00e70d34355bc13ac98cc200b6a298046ce63e55f6c7a05668bd181c

C:\Users\Admin\AppData\Roaming\Oracle\lib\security\local_policy.jar

MD5 57aaaa3176dc28fc554ef0906d01041a
SHA1 238b8826e110f58acb2e1959773b0a577cd4d569
SHA256 b8becc3ef2e7ff7d2165dd1a4e13b9c59fd626f20a26af9a32277c1f4b5d5bc7
SHA512 8704b5e3665f28d1a0bc2a063f4bc07ba3c7cd8611e06c0d636a91d5ea55f63e85c6d2ad49e5d8ece267d43ca3800b3cd09cf369841c94d30692eb715bb0098e

C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs

MD5 91c7195d1abf0081758ce00c8248732c
SHA1 9f8852ffcba434070e23dc2e1f22b3b284ba8854
SHA256 a8e6daf874fa9854c80eb6aba7b4d327b641f74d95033adc2a80c6d6d0ba26e2
SHA512 c1d464158aa86c622becb197c0f95c9d2b24d5e9cd38707ae47e6d7b2f614cb1f99f146c9288e1e93c6b103b0e78471544ca1b08bb08d24bfde758e894626377

C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

MD5 a56686411fc41f3abeea19f129935ee9
SHA1 6cb98bbc9d0e779a44dd0608cb2c7645c33de4e6
SHA256 0f906562f61761f3c66150362abfb04b4ca37c82071e91cc89d43fac5d7425ec
SHA512 be74f0a89c702e189d617a96d6b36506777c48ad41a2daaf43d7bf5719b8055de34ee567417b75ee6fadc1fa740a7e1c5f8d890723890b2c9e49965e469f352e

C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

MD5 b140730c68a0d3e52d4533f4fb32dce8
SHA1 82687e557c57534f1e54f14a016eaac0f375e83d
SHA256 88cabc3823364a5abf3525f0aeaee11ba7353796e78cfb1aa5c047c35db2d943
SHA512 9f1cdee973c9c16b2f965118e12df571410c8e5bfb010e8738231ad59548c2999673f57f963cb3e4a2d71d6bc4fd714b4624556ed3530fa9b987a82fa5c7d4fe

C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar

MD5 34b24a98bd43143f16fa0bca098c9a47
SHA1 40c306107ee9e284c89d92ce40d4abe511c202f8
SHA256 d9d8328c652819cba0a9f332aa65d2ed86f08ab8c2dc55353ac640cd687fad4b
SHA512 e8e330f60d3d7ef1e79988117ea06a0dbb69aad3a19c8c08e2473fe8b64b041375a719d4605cfc3e50567a0413d58ed52c3caf6d0b971c8cae3878fbade35295

C:\Users\Admin\.oracle_jre_usage\50569f7db71fa7f8.timestamp

MD5 e873b53892eba1fb362fbd299f2ffb08
SHA1 89d6cd5fb98bd1cd3a4ff8dc16cea054f9d9d3f8
SHA256 b3f2be0ca9e9ca5176e9d6f3f4af5dd0005c14bf88452ce4fd8f42c160ea7621
SHA512 2b70c812e09cd1bd3e35ddeecd34933ac349a0696a81df77fb703d2147585d4f6ae8ea08582454ebc20a195dbfc7cd77944639f464a1007f69f9de6b5b5de451

C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

MD5 68930e83a010c461b783ab4a1d043932
SHA1 3f9c4e63dc60de5b7d5b872ac89d864fafab159b
SHA256 3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b
SHA512 458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886

C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties

MD5 2ed483df31645d3d00c625c00c1e5a14
SHA1 27c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA256 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
SHA512 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

MD5 68930e83a010c461b783ab4a1d043932
SHA1 3f9c4e63dc60de5b7d5b872ac89d864fafab159b
SHA256 3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b
SHA512 458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886

memory/3156-265-0x0000000002700000-0x0000000003700000-memory.dmp

C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

MD5 89ab2a94e87122dffec8dfc347615cc0
SHA1 1aa55e1769bc42e1dff51e76c1380eb33cb4ed1e
SHA256 f2a64dcc3d6eae7f7ad66954189daf4165ed97cbc5315babfbb04757b235e99e
SHA512 0047ddd2e5292665d29bd5854032dfec604cd27665d8eee0ba720f17f080374c264de8b42be5497514acf2b08b82a92d88c6e57eefde687f81efe556ad73380e

C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

MD5 86588a13a4acb85da6aaea8ec495205c
SHA1 07ff3c0d1dfa88d0b8cfe7ea922ff69338d0ec95
SHA256 b0e1156dac42115208f2ae9063624ae10661474a1f775592d9b47e46fb8a8c63
SHA512 7b1a294009df32ba96ec379bf651cb7bfc20ac55ae4840a6918fa65a17539ddbffc1496f611e0886aa5d4f819bf594c30bb8184eab4bb118fccd2623746fc181

memory/4640-272-0x0000000002890000-0x0000000003890000-memory.dmp

memory/4048-273-0x0000000000000000-mapping.dmp

memory/1072-275-0x0000000000000000-mapping.dmp

memory/4640-276-0x0000000002890000-0x0000000003890000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive1543179040232507171.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

MD5 7a04210ba8c986ea53b4f4f685cf9c42
SHA1 90ee52ad6ac4565977c05999240696587bfff955
SHA256 e88901f0adea284f651316c87b2e48deffae2f803db0c929d429dd0b4390e4c6
SHA512 ab43fd38b0f5eedc0827222298331983db41606a1ecc1786b6c0b566b613df6bf123a8905efd81f6adace3d5a415fa5d840f9ed4f6f9f1f5e49a1760423f581c

C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

MD5 68930e83a010c461b783ab4a1d043932
SHA1 3f9c4e63dc60de5b7d5b872ac89d864fafab159b
SHA256 3d70d9ac6f6e875c0b0aabfaed20533c8a6ab85b28c8f45011b358d2dd15bd9b
SHA512 458900c0224b1cec1311de2585990102f49bc211a664af8bbf0c2daf4d0bf990180fd15e771146b0c479f20e68f3543ed1b114ab4c6a249c841ddcb386fb6886

memory/2380-284-0x0000000000000000-mapping.dmp

memory/4344-286-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive4833113266882752586.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/4156-288-0x0000000000000000-mapping.dmp

C:\Windows\System32\test.txt

MD5 a9b88c5d4238cc0e300eaa014fce1ae9
SHA1 1beecc84650577fca113c2734398690d1301a28f
SHA256 0a5509572004e2b53cea7c24146fcd1184609e293055d27657b0d0663a4458c7
SHA512 5a5e0babe05ee979393c26ec994e092f4e9244eda872529bc9b65e3b04d6b4ce2ff5e3bc9c69979aab4bd1e5a90ff9d97709a7da95ff59e7d9601d7f0c75bc83

memory/4092-292-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Retrive6470091634773774970.vbs

MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

memory/3276-293-0x0000000000000000-mapping.dmp

memory/2368-295-0x0000000000000000-mapping.dmp

memory/2428-296-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

MD5 3bce03cc24cb8e4a36c6beb71d98e850
SHA1 2c0423efd5a3dcd54ac8d9805c0ca0aace2f2097
SHA256 f54990046c77bc5a62f06969ad78039b19c4681d09f4ab1c5112de5a87433631
SHA512 2a20899efb6d8417c9312c578f1d519cb21559a162b839ec2db7a6e81de99c025d1dbcbdbc330a078e5acb4a53ecdf514e7ba7444b18fa9ce7b8da6cfd0e4253

C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll

MD5 3bce03cc24cb8e4a36c6beb71d98e850
SHA1 2c0423efd5a3dcd54ac8d9805c0ca0aace2f2097
SHA256 f54990046c77bc5a62f06969ad78039b19c4681d09f4ab1c5112de5a87433631
SHA512 2a20899efb6d8417c9312c578f1d519cb21559a162b839ec2db7a6e81de99c025d1dbcbdbc330a078e5acb4a53ecdf514e7ba7444b18fa9ce7b8da6cfd0e4253

C:\Users\Admin\AppData\Local\Temp\Retrive5694869614002335315.vbs

MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

memory/1700-301-0x0000000000000000-mapping.dmp

C:\Windows\System32\test.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4640-304-0x0000000002890000-0x0000000003890000-memory.dmp

memory/4640-305-0x0000000002890000-0x0000000003890000-memory.dmp

memory/4640-306-0x0000000002890000-0x0000000003890000-memory.dmp

memory/4640-310-0x0000000002890000-0x0000000003890000-memory.dmp