adwind | 10651be0ea489a1fa1984a91dae008b0a6e0df720000ccbc64d93b0d69457df9

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4825864f323cb3b4fda23fcd67a91ea4_JaffaCakes118.jar
Size 634KB
Sample240515-1f4desde43
SHA256 10651be0ea489a1fa1984a91dae008b0a6e0df720000ccbc64d93b0d69457df9
MD5 4825864f323cb3b4fda23fcd67a91ea4
SHA1 ee2bffa975242a485ec5ba5744afbb75036f9b59
SHA512 68f800685c4837e13f4cb31b51bcec15c1ae515c3270bba0b777aeec3d5eb08caf2fd3f3c1f9e07fe2e47e9a1210481e13cee9e7bf4dc58aef0287b16a63d36c
SSDEEP 12288:+CsA4/9d+Xvx/qTNzSMnUI5Ybc+F+ULVrqYry6rCEjI0dg26p+ee77dcjL8:+Cs3/rAvx/qThJnUIXYV2YrjCEj9g26+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind discovery evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind5

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe

Blocklisted process makes network request 6 IoCs

flow	pid	Process
9	3412	WScript.exe
51	3412	WScript.exe
79	3412	WScript.exe
101	3412	WScript.exe
131	3412	WScript.exe
145	3412	WScript.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldRTM.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\njeeves2.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCHelper64.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schmgr.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cis.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7PSSrvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSM32.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKProxy.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSSVC.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7AVScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psview.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Medic.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAService.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bavhm.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7SysMon.Exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCS-Uninstall.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe\debugger = "svchost.exe"	regedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LsLYFTuYHf.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LsLYFTuYHf.vbs	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2152	javaw.exe
1872	java.exe

Loads dropped DLL 24 IoCs

pid	Process
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
2152	javaw.exe
1872	java.exe
1872	java.exe
1872	java.exe
1872	java.exe
1872	java.exe
1872	java.exe
1872	java.exe
2152	javaw.exe
1872	java.exe
2152	javaw.exe
1872	java.exe
1872	java.exe
1872	java.exe
2152	javaw.exe
1872	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1132	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LsLYFTuYHf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\LsLYFTuYHf.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LsLYFTuYHf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\LsLYFTuYHf.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntfsmgr = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ntfsmgr.jar\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yRwFPtcQAsW = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\wjYUoJxSPmp\\zDCfoWxqwqb.IIXREO\""	reg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
3536	taskkill.exe
2160	taskkill.exe
4480	taskkill.exe
4472	taskkill.exe
4072	taskkill.exe
1432	taskkill.exe
4472	taskkill.exe
1312	taskkill.exe
4408	taskkill.exe
4648	taskkill.exe
444	taskkill.exe
5012	taskkill.exe
1428	taskkill.exe
3776	taskkill.exe
4804	taskkill.exe
1764	taskkill.exe
1468	taskkill.exe
756	taskkill.exe
1188	taskkill.exe
5004	taskkill.exe
1420	taskkill.exe
4168	taskkill.exe
3436	taskkill.exe
2944	taskkill.exe
4064	taskkill.exe
3620	taskkill.exe
4408	taskkill.exe
4548	taskkill.exe
1288	taskkill.exe
2260	taskkill.exe
4712	taskkill.exe
1136	taskkill.exe
2672	taskkill.exe
464	taskkill.exe
1172	taskkill.exe
4788	taskkill.exe
3436	taskkill.exe
4880	taskkill.exe
5060	taskkill.exe
2400	taskkill.exe
448	taskkill.exe
1572	taskkill.exe
1832	taskkill.exe
4796	taskkill.exe
4488	taskkill.exe
4776	taskkill.exe
3428	taskkill.exe
1136	taskkill.exe
4876	taskkill.exe
4652	taskkill.exe
3832	taskkill.exe
2592	taskkill.exe
3600	taskkill.exe
1352	taskkill.exe
1588	taskkill.exe
3264	taskkill.exe
3684	taskkill.exe
4376	taskkill.exe
5100	taskkill.exe
544	taskkill.exe
3892	taskkill.exe
1716	taskkill.exe
3000	taskkill.exe
1880	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	wscript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4960	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4632	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	1428	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	444	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	1136	taskkill.exe
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	448	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	4948	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	464	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	1428	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	528	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	544	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4392	javaw.exe
3948	java.exe
2152	javaw.exe
1872	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1132	2944	java.exe	84
PID 2944 wrote to memory of 1132	2944	java.exe	84
PID 2944 wrote to memory of 872	2944	java.exe	86
PID 2944 wrote to memory of 872	2944	java.exe	86
PID 872 wrote to memory of 3412	872	wscript.exe	89
PID 872 wrote to memory of 3412	872	wscript.exe	89
PID 872 wrote to memory of 4260	872	wscript.exe	90
PID 872 wrote to memory of 4260	872	wscript.exe	90
PID 4260 wrote to memory of 1880	4260	cmd.exe	92
PID 4260 wrote to memory of 1880	4260	cmd.exe	92
PID 872 wrote to memory of 4392	872	wscript.exe	94
PID 872 wrote to memory of 4392	872	wscript.exe	94
PID 4392 wrote to memory of 3948	4392	javaw.exe	95
PID 4392 wrote to memory of 3948	4392	javaw.exe	95
PID 4392 wrote to memory of 1828	4392	javaw.exe	97
PID 4392 wrote to memory of 1828	4392	javaw.exe	97
PID 1828 wrote to memory of 396	1828	cmd.exe	99
PID 1828 wrote to memory of 396	1828	cmd.exe	99
PID 3948 wrote to memory of 2212	3948	java.exe	100
PID 3948 wrote to memory of 2212	3948	java.exe	100
PID 4392 wrote to memory of 3180	4392	javaw.exe	102
PID 4392 wrote to memory of 3180	4392	javaw.exe	102
PID 2212 wrote to memory of 4752	2212	cmd.exe	104
PID 2212 wrote to memory of 4752	2212	cmd.exe	104
PID 3180 wrote to memory of 3716	3180	cmd.exe	105
PID 3180 wrote to memory of 3716	3180	cmd.exe	105
PID 4392 wrote to memory of 4472	4392	javaw.exe	106
PID 4392 wrote to memory of 4472	4392	javaw.exe	106
PID 3948 wrote to memory of 384	3948	java.exe	107
PID 3948 wrote to memory of 384	3948	java.exe	107
PID 384 wrote to memory of 3684	384	cmd.exe	110
PID 384 wrote to memory of 3684	384	cmd.exe	110
PID 3948 wrote to memory of 4588	3948	java.exe	112
PID 3948 wrote to memory of 4588	3948	java.exe	112
PID 4392 wrote to memory of 1148	4392	javaw.exe	115
PID 4392 wrote to memory of 1148	4392	javaw.exe	115
PID 4392 wrote to memory of 4960	4392	javaw.exe	120
PID 4392 wrote to memory of 4960	4392	javaw.exe	120
PID 4392 wrote to memory of 4568	4392	javaw.exe	121
PID 4392 wrote to memory of 4568	4392	javaw.exe	121
PID 4392 wrote to memory of 224	4392	javaw.exe	122
PID 4392 wrote to memory of 224	4392	javaw.exe	122
PID 4392 wrote to memory of 2152	4392	javaw.exe	123
PID 4392 wrote to memory of 2152	4392	javaw.exe	123
PID 2152 wrote to memory of 1872	2152	javaw.exe	128
PID 2152 wrote to memory of 1872	2152	javaw.exe	128
PID 2152 wrote to memory of 3684	2152	javaw.exe	130
PID 2152 wrote to memory of 3684	2152	javaw.exe	130
PID 3684 wrote to memory of 3220	3684	cmd.exe	132
PID 3684 wrote to memory of 3220	3684	cmd.exe	132
PID 2152 wrote to memory of 1028	2152	javaw.exe	133
PID 2152 wrote to memory of 1028	2152	javaw.exe	133
PID 1028 wrote to memory of 1192	1028	cmd.exe	135
PID 1028 wrote to memory of 1192	1028	cmd.exe	135
PID 1872 wrote to memory of 972	1872	java.exe	136
PID 1872 wrote to memory of 972	1872	java.exe	136
PID 972 wrote to memory of 3780	972	cmd.exe	138
PID 972 wrote to memory of 3780	972	cmd.exe	138
PID 2152 wrote to memory of 4088	2152	javaw.exe	139
PID 2152 wrote to memory of 4088	2152	javaw.exe	139
PID 1872 wrote to memory of 824	1872	java.exe	141
PID 1872 wrote to memory of 824	1872	java.exe	141
PID 824 wrote to memory of 876	824	cmd.exe	143
PID 824 wrote to memory of 876	824	cmd.exe	143

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4568	attrib.exe
224	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\4825864f323cb3b4fda23fcd67a91ea4_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1132
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\bamvtkflbt.vbs
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\LsLYFTuYHf.vbs"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:3412
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version 2> C:\Users\Admin\AppData\Local\Temp\output.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version
      4⤵
      PID:1880
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ntfsmgr.jar"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.62349118262932483401685116304089551.class
      4⤵
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7996044330802005758.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7996044330802005758.vbs
        6⤵
        
        PID:4752
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5877666881870986563.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:384
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5877666881870986563.vbs
        6⤵
        
        PID:3684
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4588
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4477109752304094422.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4477109752304094422.vbs
        5⤵
        
        PID:396
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2958650698700954268.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2958650698700954268.vbs
        5⤵
        
        PID:3716
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:4472
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:1148
  - - C:\Windows\SYSTEM32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yRwFPtcQAsW /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\wjYUoJxSPmp\zDCfoWxqwqb.IIXREO\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4960
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\wjYUoJxSPmp\*.*"
      4⤵
      Views/modifies file attributes
      PID:4568
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\wjYUoJxSPmp"
      4⤵
      Views/modifies file attributes
      PID:224
  - - C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\wjYUoJxSPmp\zDCfoWxqwqb.IIXREO
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.94957113862061392422301979698681399.class
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6592673906711484255.vbs
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6592673906711484255.vbs
        7⤵
        
        PID:3780
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8208717417765596094.vbs
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8208717417765596094.vbs
        7⤵
        
        PID:876
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        6⤵
        
        PID:4044
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1398774243067054959.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3684
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1398774243067054959.vbs
        6⤵
        
        PID:3220
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2293003741451574807.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2293003741451574807.vbs
        6⤵
        
        PID:1192
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4088
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\pvDBkLbsir2472612381267649489.reg
        5⤵
        
        PID:1228
      - C:\Windows\regedit.exe
        
        regedit.exe /s C:\Users\Admin\AppData\Local\Temp\pvDBkLbsir2472612381267649489.reg
        6⤵
        UAC bypass
        Sets file execution options in registry
        Runs .reg file with regedit
        
        PID:4632
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM UserAccountControlSettings.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ProcessHacker.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM procexp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MSASCui.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MsMpEng.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MpUXSrv.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MpCmdRun.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM NisSrv.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ConfigSecurityPolicy.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM procexp.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM wireshark.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM tshark.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM text2pcap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM rawshark.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mergecap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM editcap.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM dumpcap.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM capinfos.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbam.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbamscheduler.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbamservice.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareService.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareTray.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1136
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM WebCompanion.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:364
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareDesktop.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Main.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Svc.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Up.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3SP.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Proxy.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Medic.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BgScan.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuard.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuardBhvScanner.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuarScanner.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM LittleHook.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:464
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuardUpdate.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM clamscan.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ClamTray.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ClamWin.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:744
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cis.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM CisTray.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cmdagent.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cavwp.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM dragon_updater.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MWAGENT.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MWASER.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM CONSCTLX.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM avpmapp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM econceal.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM escanmon.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM escanpro.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM TRAYSSER.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM TRAYICOS.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM econser.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM VIEWTCP.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSHDLL64.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fsgk32.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fshoster32.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSMA32.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fsorsp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fssm32.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSM32.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM trigger.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FProtTray.exe /T /F
        5⤵
        
        PID:5036
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FPWin.exe /T /F
        5⤵
        
        PID:4160
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FPAVServer.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3832
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVK.exe /T /F
        5⤵
        
        PID:3404
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GdBgInx64.exe /T /F
        5⤵
        
        PID:5044
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKProxy.exe /T /F
        5⤵
        
        PID:4528
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:5004
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKWCtlx64.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4472
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKService.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3600
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKTray.exe /T /F
        5⤵
        
        PID:3140
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDKBFltExe32.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1352
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDSC.exe /T /F
        5⤵
        
        PID:3304
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM virusutilities.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3428
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM guardxservice.exe /T /F
        5⤵
        
        PID:3440
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM guardxkickoff_x64.exe /T /F
        5⤵
        
        PID:1948
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM iptray.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4064
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM freshclam.exe /T /F
        5⤵
        
        PID:3232
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM freshclamwrap.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:5012
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7RTScan.exe /T /F
        5⤵
        
        PID:4524
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7FWSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4796
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7PSSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1420
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7EmlPxy.EXE /T /F
        5⤵
        
        PID:1704
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSecurity.exe /T /F
        5⤵
        
        PID:2144
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7AVScan.exe /T /F
        5⤵
        
        PID:4616
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7CrvSvc.exe /T /F
        5⤵
        
        PID:1840
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7SysMon.Exe /T /F
        5⤵
        
        PID:1592
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1172
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMngr.exe /T /F
        5⤵
        
        PID:5020
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nanosvc.exe /T /F
        5⤵
        
        PID:4652
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nanoav.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1136
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nnf.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4788
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvcsvc.exe /T /F
        5⤵
        
        PID:3956
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nbrowser.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1588
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nseupdatesvc.exe /T /F
        5⤵
        
        PID:1560
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nfservice.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2672
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nwscmon.exe /T /F
        5⤵
        
        PID:1564
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM njeeves2.exe /T /F
        5⤵
        
        PID:3000
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvcod.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4648
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvoy.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1188
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM zlhh.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4876
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Zlh.exe /T /F
        5⤵
        
        PID:2400
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nprosec.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4472
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Zanda.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4480
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM NS.exe /T /F
        5⤵
        
        PID:1832
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM acs.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3436
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM op_mon.exe /T /F
        5⤵
        
        PID:2160
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSANHost.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4880
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSUAMain.exe /T /F
        5⤵
        
        PID:2576
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSUAService.exe /T /F
        5⤵
        
        PID:4592
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AgentSvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3620
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BDSSVC.EXE /T /F
        5⤵
        
        PID:1608
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM EMLPROXY.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:5100
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM OPSSVC.EXE /T /F
        5⤵
        
        PID:1856
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ONLINENT.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:3892
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM QUHLPSVC.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:4408
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SAPISSVC.EXE /T /F
        5⤵
        
        PID:4616
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SCANNER.EXE /T /F
        5⤵
        
        PID:3968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SCANWSCS.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:4804
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM scproxysrv.exe /T /F
        5⤵
        
        PID:2592
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ScSecSvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:5060
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SUPERAntiSpyware.exe /T /F
        5⤵
        
        PID:388
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SASCore64.exe /T /F
        5⤵
        
        PID:1972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SSUpdate64.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1716
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SUPERDelete.exe /T /F
        5⤵
        
        PID:3436
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SASTask.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1764
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7RTScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1572
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7FWSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2260
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7PSSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4712
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7EmlPxy.EXE /T /F
        5⤵
        
        PID:5048
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSecurity.exe /T /F
        5⤵
        
        PID:536
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7AVScan.exe /T /F
        5⤵
        
        PID:2300
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7CrvSvc.exe /T /F
        5⤵
        
        PID:4524
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7SysMon.Exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3536
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 17b90c1454b043e89939291cf6c26e415d9e42b003b0bcb4e7bcf178ee99335a
MD5 6344af8d04c19c4820deba24cf5561a5
SHA1 40eca67807770e24cdf1b8765f3f5293372b1ac0
SHA512 46bf30eac884df82177fe20bf509d24fac9c532755cc49eeefedca147bc75f0b3a0de3603410f2ca47f53b933815f2de3181a8fba3db6dd8f45d4e4097e8a842
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a384d2fe6fee11e3b74402affdb8d5b5371c51011067f6754eb1ae39b8e5f08a
MD5 06a1d2582575c35eb3111017a8884c57
SHA1 d8b24fb77df61311cd3e2735983c80873415b6be
SHA512 c01769d93c326052ef228f38e8660286b7683cc94b90b653c53c97782af972a5a66001d3c8f32954516080403b2d08ead7aa027473ab96617d29f7b428a09491
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 dbb6523d9e72c346d7873fa3f108eccead15db1a57bab87c42585156e27e51a0
MD5 f143c17d76af85c49a8802ab2bffa939
SHA1 e2631ba35ce1c1417ff2fcb62ca7ee3e8d6b4334
SHA512 f0f2736a2969e2f64489530a2f263cfb6f1c777a92582b5b6ca9cd63ddf89d1c0d924dbf98db7cc1a7e1f5742c3923ade302ef6d3f82fc751acff83736c64057
MD5 SHA1 SHA512

Submit Download

50569f7db71fa7f8.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp
Size 54B
SHA256 6f4a3dec5797d2b187cc9f58b1511dbb902938f2c71ff7cfd7af5326a617332d
MD5 d86a2b62652af119503dc5dd04b594d4
SHA1 a53a4e3fe5dd985c5ba9c76804e30d19084c5bc3
SHA512 b0af2e1a7375f4faeddba3cc0b2f11ed56ac4f15ee5a0f650a8e961788c46341b98dea9c97d495ed5abbc62eb3a6f38c54abe803f9bd49791984bf13ce022fdc
MD5 SHA1 SHA512

Submit Download

Retrive2958650698700954268.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive2958650698700954268.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive4477109752304094422.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive4477109752304094422.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

_0.62349118262932483401685116304089551.class

Path C:\Users\Admin\AppData\Local\Temp\_0.62349118262932483401685116304089551.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

output.txt

Path C:\Users\Admin\AppData\Local\Temp\output.txt
Size 147B
SHA256 4ebfda517657bcc9f2b2e3c3cd13e58e9adef320c0ca1a8ac9aee888d4e1ef8e
MD5 faf2f8b188047379978915849af13d28
SHA1 42ecb6f269f3dc3183d3b72b4216010f106d3317
SHA512 85c3afedfda0aa63edab3b1c5ed7ef8b06e392d387ea3c16bd28c66a54f72c7cbdd14b8af9428168402313f8a4d203be7e5f8a6732d0d8d52d46fe3963ebde79
MD5 SHA1 SHA512

Submit Download

LsLYFTuYHf.vbs

Path C:\Users\Admin\AppData\Roaming\LsLYFTuYHf.vbs
Size 19KB
SHA256 77690c11040ff5aa1fb624de3665e94c67382d36f2d6a12d3f6ae11618db45c4
MD5 d1ba67a63beb4875389959321df190eb
SHA1 4a505537412699931ad4472aff74c2db6febe02e
SHA512 cb5e6a76056f83079f964b156699df26e8064a3cb1260479b17382a188d6ee83efe18a437ed1225cbc40141c6f43a8ee3e0955e3e5294f3b8fcf1d2a5ee87ac3
SSDEEP 384:UFrBkLB2eSks4XZG8C5KhP3EzmuX/n/tzKwVPrgkIy3iegNM:UFrBktf8Kh/t+lzHtIg
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_4d0966de-9ba4-4ee9-b282-eaf9cf9c9160

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4018855536-2201274732-320770143-1000\83aa4cc77f591dfc2374580bbd95f6ba_4d0966de-9ba4-4ee9-b282-eaf9cf9c9160
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
Size 1.3MB
SHA256 3bf975bbb65d9af983cee29afb32fe8e260bb9063f7948a132dcf9edfc1bf5b2
MD5 88533755e937c3f8075e4fb9171518ed
SHA1 32190e58f984abbbc9c258dbc2113e54efcbd456
SHA512 0cf01dfdf5b48e735b9b008355968e869d199e2dce534cb3fd3d68578b68e7c1a46727f87927ee84eb1fbab6b9e90b4a98f0c91837f384f257249fb43fbd97d6
SSDEEP 24576:1WTbd7G2sOA8mlOVIor9HgHsS1E4K+32mxMnjtbTq94bK24zvBE9J:kTZ7G2sCmlwCC3+G9njpT6j24ziJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Size 162KB
SHA256 9bc9178d3f4246433fe209a0f5ca70e77568e80c928268c78f8c8b00107ce6ed
MD5 583e8b42864ec183c945164f373cb375
SHA1 5ec118befbb5d17593a05db2899ee52f7267da37
SHA512 1feaac37bac19bde93171ebda2e76a65e9d5472a503b05939f6977b3a4d94d131298f3989dd048d7617ecd69cf09db7ac986fc39f0df9f56c84ea01726d0c898
SSDEEP 3072:WgpGH1/rHpcDJ0oLwZLVZcPmsrS7DggYt:Npg0Q/HQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
Size 285KB
SHA256 366199821c1efede3f7112d21da045fd6bf38b56fb3da1ae9d6493c4ddc1861f
MD5 1562e15220d8771fcb11b9a5b234a970
SHA1 50ec8e4e7125bda147a1b2ccc2b2827db2dc3479
SHA512 a07873f0a5381d202a6439a3245dd51f405cdcec4a9d40ff6ffdd4670a3b218008f7288a89e2a7455782c677d4c661bda96e62f813ce7d8c1f20a6c4c7c2b31f
SSDEEP 3072:pLBM1lpzb9ydKHsz1//3H+ktNNWo7vNnParlMhubG0XqkwnJEszNvarvcLGYDJ6f:ZWPZw225bN5zFEjGkqkAJHyECYVO+vVU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Size 285KB
SHA256 dd2169db3358ccdf4a4a185e4a22955c989eaa3b9d3e0e6025599b8fa173c968
MD5 122e34bfa3146ef9ae5a51fdc744353f
SHA1 f0cc2294fe150a4cceca8a3da8615edcc4eb20e4
SHA512 306341e00598f02a70d3edc6ef666cb64982f1e31e5c0a1304977a1700c95395c1c7f0857ae8056853370eced0bd2aeafc72da804a65f98c1422929b7c431700
SSDEEP 6144:1AHdwS/WYoTOLHIsPPzAdnzdYunYPMvo7M:1Cd9/WYoaLHF3z0zdOPMvo7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
Size 104KB
SHA256 b090636931f9b5767c2a2c82ca4e5efbf65ce1a79630b48dea47ed01e1d81988
MD5 818fc60312c5ef0010e1a0367019005c
SHA1 bec6ce9b8330bd90c6f0527aa01871ec6b2ab018
SHA512 43339d3407aaf85fa94aa3ff22ed3f457b29c93403a7ea19abbec50d4b5fee14fd415e70ac856a84c76530571a5a03eb8c5eae558edad6a64fcc3a3755dc3d5c
SSDEEP 1536:cvpp3y2kIlAYVZ+qbzKWrTcJuV618k89DmucOiG/OJY9GzoAiKyy3CLLLf67/xz:rYSqbzKWrTcJuGbEDmYGeffYCDf6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
Size 66KB
SHA256 35b203dbdf6716bd7e35a66127acb5ae7d869388ee3778e8a956d1b54bfd15a1
MD5 4c8dbf6bb8438a43adecb07b90ec37d4
SHA1 d33ac1a59b79a8894f0225eca238b6c40649145b
SHA512 fc08a1390c87fb077758887cd89acec0326ac5332cb380771d8d0edd9e810c8e7fad43ad5800577307cad4ffb3007266d5cf56c7c726bac3939d908ac86eff8f
SSDEEP 1536:0lONFYKAQn7Xur2u5bCCJ3Khyb97gzSxi0:0lFjuXuyuhC63Khyb9Me
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 8.5MB
SHA256 9f28a06990d2ed1d14130072109e37e733b3a7d4922e325e679dd4d917741550
MD5 36e3e370db5f0b66689811b41f1a8445
SHA1 7fcbe290c3a6a0827b77af78115a1b4bc834d685
SHA512 f93bc4ca946e383ee1edfef3c7b5574585d23d660a4cc3db5b6b203f6111a3fe1f245d583ca53852888ac67812fb6efd0d121d0643180875baeb0d7b811d4db9
SSDEEP 98304:gtflWD/4ZmE8Rrqc/vvwN3JpjJ8h6BO8QZ4VXOyO18c:gtflWD/VE85qG3sZJ8aO8a8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
Size 142KB
SHA256 f70ceddab71854c9c59f412cec6be5d6b918a1b2ee23f7952354a00b71cc407a
MD5 fd3dcda8909ec5575b3b0acf6f219585
SHA1 4ae6dc79730e54231ff1f970515e3a16a4287fa6
SHA512 16b24f09943b7b92a92adfbdac6a274147e9eb54eae5a2d24eb07129dfced0b9b4f2ddaff6cf3e21c295af99f4b676be9084d72a1493d6c3cba9c91535a4bfb5
SSDEEP 3072:qzs5pH2Lmngo9QVKTIVbheI14/QwwwS6ycVvT:Gs5pWLmngo9HTMhp14vpycF
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Size 55KB
SHA256 b1cf5a699d1a48691c2fe8dfad1c8c8aa1c4013c52b4107bad905faf037ddffa
MD5 0fcda2fc9a161614e68d74f4d9eecc2d
SHA1 d3734149ff561209aa9e851ea958012e20ce41da
SHA512 5402af47558721f084f5f05264e160bd43ebe265c2d2e3b415c2a0ea7bf9adf7aebb76e2c12dcf93ae5bf10d00f4c80aa3a97f35c02eb3279df9c675f3a037bc
SSDEEP 768:bCZgHDAkEie59zTh6p/yMPZb6rvTf1YNVzX2H9l0WFAhYiWOAMxkEm:bCZW/ve59uNd6LTf1EaH9lXFAh7W8xS
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Size 87KB
SHA256 c3c3365932d865e111972184ae12dc3853dc7e5d6df2f474dbeee5faead92cd3
MD5 2ca64779a19ba733a408edd9511b7c37
SHA1 99ad8571bc8cd48efba19a48066c0f0dd321ecc1
SHA512 0822bb0e4d18115d325f3981ad15cb036d5a9f845d2c68975c5e9164b5fbdab0fdd4e882d3b8001f58271b7b38cba9bdc1299ccfab00ce0321f396aa8bf248a5
SSDEEP 1536:p4oESIZDpOoUQ4Ps5OwVOIOQIO6nAFqL8xE7/Nxa:p4o5IZDZUXwV8G6nAFqL+EDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
Size 634B
SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
MD5 499f2a4e0a25a41c1ff80df2d073e4fd
SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
MD5 SHA1 SHA512

Submit Download

charsets.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar
Size 2.9MB
SHA256 94e16e5ba8033fc3cd2a2e731b6326958dfe7c9b70fd4826eb2c0709a656d83d
MD5 a5b8d1a15884d8450ec905fc08d6e1d2
SHA1 472cdfe3f3bf1e719e3bc73f008f26960d2a74fc
SHA512 3eee8ff3e969161d551903a1687db379f516ddfe4bec35c508964012a58895a45a36d4efcd06a60448f3ec764c4f3dd7e317445c32e23b8c888b68361747e330
SSDEEP 49152:+Nip3z1nHSXNvjCVUOxgyhJYknvvXHlbIgCm5:+Ni1zN4tCa4n33lbIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages_zh_TW.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
MD5 SHA1 SHA512

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index
Size 1KB
SHA256 8c55ed28260fcd7fd4e5d68e871a735148c01a711545602c2c26aa9d6653c05c
MD5 af03d781ec85caa0f45e6e29830ce112
SHA1 ef3dd2f731903182e47cb83cdf275f5f0e58b3db
SHA512 df080f8c206ba125f5ce4129640fc05e9fc5b00fd87fe08866bbc7b67f5caa3ec2792dd874d49253a70ea0a9c3856c2e8ba4c39728656854a290cfdf6ba683a3
MD5 SHA1 SHA512

Submit Download

sunec.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar
Size 46KB
SHA256 6507274374d7d50eb6bf5998288760988deccc16ed7934ad8a182c2500f0405c
MD5 5aff6406c285d0ef2e8d7946b2eb01f8
SHA1 fef27bfeff7242ea820c90665d684fcacd770505
SHA512 c94f1b7d30d74914ed973892f8f3200a20206caeec41e99feef9b58b9e4354260b396eb464e2162d740315f000d7bd1c811ef7520301fdc65dcfd0af648deb65
SSDEEP 768:qJ0hA5edlfURu2ZgcVMbLjwP240brx6iel3slNJSkj64SlKAPX+9V+qMmOAwSeut:qiaoFUoOx6f40b967xslNJSxNjPX+n+g
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunjce_provider.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
Size 288KB
SHA256 a5d33f76829de19bd1eef234cf148c1f984707480befa81b4811bad21886a050
MD5 d48c3b0a549c1b0a72cc5bc63a4cc979
SHA1 542d860693da662555cea10986e533e374b52326
SHA512 f8f8e949bfc809a8504d810ceb4e75aad27008aba9aba27bc84dba77ebb7c05f8dc7f8a33b83d51d0872f9ce43ede3f26a51e9fc8eb17558c72b684c2bed73d6
SSDEEP 6144:p3/QdFfQWe9D4westkLV9mYqBZSlVTvUBeUxVWt+npE:RQW9DJyVIJBZSjUBeUXVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

win32_CopyNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

jce.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
Size 120KB
SHA256 f5700ffd6842bff801307c09e02ce3ca9792eb2cd4d34e79563bf77ff44ae531
MD5 99247d1d5370a784e438416e599abe36
SHA1 2f958cccadeb2d991e41edccece08bc1a64368cf
SHA512 e3380e411f1b7219df659cbb4691cf3cd23c66f4af428f3b71539e579b6c2ce8209fad949f3909337a89282fd5c1d1eacf2a1acc34ff129c69c7b0bdb1b65a35
SSDEEP 3072:dF7NB1fH3Hu+upZxG4w+XlElLgdMiaXBj3a:dFZT3Hu+74PlUrRu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar
Size 566KB
SHA256 8660a4dd44225c06a79afb5e8015a74cd610c50c777b4b2737008d179b69dd83
MD5 9868c5f7a74f603107ecdb43a367d91b
SHA1 6b5499786196c71c7c2ff63d1f15d70b4c0164a8
SHA512 1740c646cc0b83398ff0aa6c7b297cd4882840c9cae28fbac4914617764cc21c2026539b7eaf9209fff8d3b1df89a09299021f43910c07e434060434461daa8e
SSDEEP 12288:15l+qU67FYWg+YWgYWeoXqgYSqYQh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5cR:15l+qU67FYWg+YWgYWeoXqgYSqYQh2fN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
Size 1.7MB
SHA256 46599d42d2c0b9bc6484a5b2d5a53bb5d9b238bef9c87f006acd61cc52bdb0ff
MD5 6b4188fce8bf2334732741b2f3c3c864
SHA1 95dfc9d9709f9b6e7fce99bc02a3bc7d1fde75d8
SHA512 59cbc0820e01fcf7a62675aa9bece9afd2ca20c3cca4b7033394c398e669b0b7f7ec5ac97486fecfb6fa48187b7faa0fb1fb5987e93c6a0a5e85e99b9ddda590
SSDEEP 12288:Yj/q53bPCBTi4r5SCqlgmZn3fr5/qlhLLHfyTc:Yj/OH4r5SJl3nPpqfZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
Size 2KB
SHA256 6bd7ea02b9456a3730755e76d4ee1ccc04c524e93366cd74d7f42ac628d4ec77
MD5 689c0cbde7697f43642bf1134f4b70af
SHA1 307db1c4a9570f01479dea98f6b5bd33a1deb759
SHA512 13afe0797d9c2c7ab8721fbedab42225b41f45059a9167c046a11e1bf6e03ad82accaed42884dff335b66ec41d3608d0d0bd06582af51634a81550c81baff2fb
MD5 SHA1 SHA512

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
Size 3.4MB
SHA256 9dafdd0afd9f6aab6eec3f130d0c85bf5507b8535b063e17c8fa4924773470b0
MD5 181737fb6fbc7447670c89c22262199c
SHA1 11150f5ba9782d8550fd1a3d6eee889a0ca66da0
SHA512 8daad658207f9e8fd937254c453fb4be8b488cc061ce9e41df83fbd228193da9007feed3bb3ff12188c41a6b733d2851933d276d68d03f8edec3c3de602ca60a
SSDEEP 49152:CIi3Bkq+kdWTJR9Md1c0w2l6jlGbAlyy+Ed/2p4Tmaglc3UeHslPS9BdvyD02OmD:qKlin
MD5 SHA1 SHA512 SSDEEP

Submit Download

blacklisted.certs

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
MD5 SHA1 SHA512

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security
Size 56KB
SHA256 cb4819328a486176a862a35ca9ee504acb8e793bcf5ae2011e7bd89633ee6233
MD5 29b34fe1ee5b9329374ad1ef7587c7d2
SHA1 2fc188499d923a0fdbfa4ad93ac70699d0effaf8
SHA512 45f2cfc937861863485b16f663d409890ec8d53f171cb67f356a13c2d34e7a1c8e01114dcbcc28a557a82c4cd51d2c1fcfa0570559236f5705547537a2c498a2
SSDEEP 768:rn4LHAEcqrlANbX7qL1AdL3naP2rOpOQSvbOETyqp+Z+Ijt+M38yrBsHOLIsS8eJ:rs2aVOQCbOETyqpmLjt1FLze0YKQN3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Size 7KB
SHA256 84e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8
MD5 12f971b6e65cbc7184701235469f0339
SHA1 06cb165157c5e0078b872c48707a1328b1dcba19
SHA512 58646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de
SSDEEP 192:7W3/Oi76M94KjPIsmnOyxRDuQe80clILkwwGDrRZ7exi1O:7W3/Oi7NefiQeClIwG/jqKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

local_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar
Size 7KB
SHA256 86563bc645c5ff0e998c2bb38a75a0edb337ed188e56adf57bb51a2c5415dfef
MD5 109bd5e32ffeb9454bc0dd2bfdff57a7
SHA1 c3a06b4a9e24d511d6ebb5465b30083cab4a7a28
SHA512 5a336d98c646cac2ef9499c04a29bcba55d8647d26a431dd98eb81a34cc0b29bff32dce63fc012a9b77110ba45f931911b6c674a018346916a1e12d5a6410bc1
SSDEEP 192:YjMnPeAkq0xGTJlryaMn6KOIfRNfA/x/sozWE5pyc:ilhsllrrM6KOInQx/sozWI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntfsmgr.jar

Path C:\Users\Admin\AppData\Roaming\ntfsmgr.jar
Size 479KB
SHA256 a7b42dbc3cb7ad8353ea1e7ddc9da5638abf7f53cc10443f889485fd35fa7586
MD5 14c47aca1d9eca17463dc042b06ee190
SHA1 f18fd916123c1bcb78f5b79409ed8a68025248f7
SHA512 20424c49b23de60629bba2d0a11fbf62a2f3e701443dedd4ac0aa989483cdf559dc8c898c54943416202c69a757d279efacaabce579d758304dfb5178df6792f
SSDEEP 12288:/t21Ws7z3Wm77wXn8L5pxogQNUhIK/0c2qnAv:/4SmXy8VsS7B2qnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bamvtkflbt.vbs

Path C:\Users\Admin\bamvtkflbt.vbs
Size 926KB
SHA256 e6e7067a2cbe79e105a2054b3773419b7e0c1f8b31029691ac1d64533d7fbc17
MD5 d8212f7e58dd715dece8135a7cbbb5bd
SHA1 1e43441bf5e8051076a7cebc2aadcf794c931743
SHA512 4d9d23a01ed57a144044308028db290d6718397fae06aec2406e09664c1ca6a251272e38549df48e348cd5f2921747085f6c5ff30efdfa084a4debaf8f597aba
SSDEEP 12288:pQ/NwW+ZopctCWaSMltLyUWKD3ZtkLS1pBc+dIKfQJFh/WGzeVXR3lxrkPcgTaY9:qFwW+ZoCGtLdd3ZPbCIfUjO6eXVhk9r9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ID.txt

Path C:\Users\Admin\wjYUoJxSPmp\ID.txt
Size 47B
SHA256 fab5505dadadc4ead62b2cfc83ffe5cc96c8936bee2f1183096a578ed123c016
MD5 1ab28b86448d3662b839ae20bc83f5cf
SHA1 0f2850d36f5f87f4c8efc8f87bafb6cd85d00fda
SHA512 4d6588e4acbf656477481117596d1f778a1dcaa3c3ad076cbb6bbd09a884a88dc94e91b67d4390acb7c145c6837b5fccd993a993e05a1be8cd8c6c9902d14f8f
MD5 SHA1 SHA512

Submit Download

test.txt

Path C:\Windows\System32\test.txt
Size 486B
SHA256 a9742102be28abff623a2da8a36020743c4a0f1fe9f22dfb3377d2402044f231
MD5 4586dae4aaac5582cd8077f893b0d5e9
SHA1 101b01a1c7fe4598ca872bef9ab575224a6c75a0
SHA512 c6500dc862f6553812664486e85f8710cc9a0a4d4587bd1a8ff3365e0bf44692e0b134f245e5fd82c3910bd15d8d725d3e784b7750a9e5c47fc10ce5c23bff5b
MD5 SHA1 SHA512

Submit Download

memory/1872-1144-0x000001811E350000-0x000001811E351000-memory.dmp

Download

memory/1872-1103-0x000001811E350000-0x000001811E351000-memory.dmp

Download

memory/1872-1129-0x000001811E350000-0x000001811E351000-memory.dmp

Download

memory/1872-1132-0x000001811E350000-0x000001811E351000-memory.dmp

Download

memory/1872-1175-0x000001811E350000-0x000001811E351000-memory.dmp

Download

memory/1880-35-0x00000221B2620000-0x00000221B2621000-memory.dmp

Download

memory/2152-1066-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2152-1130-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2152-1186-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2152-1178-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2152-1124-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2152-1181-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2152-1139-0x000002591EA50000-0x000002591EA51000-memory.dmp

Download

memory/2944-2-0x00000174E76E0000-0x00000174E7950000-memory.dmp

Download

memory/2944-14-0x00000174E5D20000-0x00000174E5D21000-memory.dmp

Download

memory/2944-15-0x00000174E76E0000-0x00000174E7950000-memory.dmp

Download

memory/3948-93-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-1128-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-478-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-1146-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-1147-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-1160-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-971-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/3948-1127-0x000001F0F88D0000-0x000001F0F88D1000-memory.dmp

Download

memory/4392-402-0x0000028568D20000-0x0000028568D21000-memory.dmp

Download

memory/4392-1024-0x0000028568D20000-0x0000028568D21000-memory.dmp

Download

memory/4392-91-0x0000028568D20000-0x0000028568D21000-memory.dmp

Download

memory/4392-74-0x0000028568D20000-0x0000028568D21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads