adwind | ac0a25ac066f80e9c83314be498058de0d4fc2d9f0a6fc33e125d418dc74b80c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67579e48f13ac386cd90cfc23f7873ad_JaffaCakes118.jar
Size 550KB
Sample240522-p9kbvscc68
SHA256 ac0a25ac066f80e9c83314be498058de0d4fc2d9f0a6fc33e125d418dc74b80c
MD5 67579e48f13ac386cd90cfc23f7873ad
SHA1 5c63e5f8245b9bb16f7b9f044ab2bbf63e7dbbf3
SHA512 2394988cdde9f3b393641f23efb6e99ea257348389dceff25633c23accf9f0c5f1d5d7141b6f00f6cf35fdbb0b2c6674ebdaf0a3b0ce1b4d8176f3c83429892e
SSDEEP 12288:VS2XSD5mRaGuWa/Qj0sDpW3T0f8d+locWNTGF6xpnUx:s/G/tFgTutocWhW6xWx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind discovery evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCHelper64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CONSCTLX.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMain.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LittleHook.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trigger.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trigger.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERDelete.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanosvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAService.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiUpdateTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsorsp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nfservice.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamscan.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSSVC.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreFrameworkHost.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIPREUI.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe	regedit.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4352	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
4216	taskkill.exe
4280	taskkill.exe
4440	taskkill.exe
1136	taskkill.exe
232	taskkill.exe
2904	taskkill.exe
4852	taskkill.exe
4336	taskkill.exe
2032	taskkill.exe
4368	taskkill.exe
3868	taskkill.exe
4824	taskkill.exe
116	taskkill.exe
3860	taskkill.exe
404	taskkill.exe
3324	taskkill.exe
404	taskkill.exe
2120	taskkill.exe
1792	taskkill.exe
1628	taskkill.exe
2524	taskkill.exe
4140	taskkill.exe
1720	taskkill.exe
2176	taskkill.exe
2412	taskkill.exe
4688	taskkill.exe
4008	taskkill.exe
2548	taskkill.exe
5088	taskkill.exe
3976	taskkill.exe
3080	taskkill.exe
3496	taskkill.exe
1876	taskkill.exe
1708	taskkill.exe
4464	taskkill.exe
556	taskkill.exe
4896	taskkill.exe
5112	taskkill.exe
1708	taskkill.exe
1316	taskkill.exe
3964	taskkill.exe
1172	taskkill.exe
748	taskkill.exe
3316	taskkill.exe
3036	taskkill.exe
2144	taskkill.exe
3144	taskkill.exe
1232	taskkill.exe
2784	taskkill.exe
3604	taskkill.exe
1228	taskkill.exe
1396	taskkill.exe
1216	taskkill.exe
1708	taskkill.exe
4340	taskkill.exe
3860	taskkill.exe
3628	taskkill.exe
4584	taskkill.exe
2412	taskkill.exe
380	taskkill.exe
4228	taskkill.exe
5036	taskkill.exe
1616	taskkill.exe
1628	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3304	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	1396	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	1172	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	5100	taskkill.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	1792	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	232	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	4336	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	4464	taskkill.exe
Token: SeDebugPrivilege	116	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3284	java.exe
1556	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4352	3284	java.exe	91
PID 3284 wrote to memory of 4352	3284	java.exe	91
PID 3284 wrote to memory of 1556	3284	java.exe	99
PID 3284 wrote to memory of 1556	3284	java.exe	99
PID 3284 wrote to memory of 4156	3284	java.exe	102
PID 3284 wrote to memory of 4156	3284	java.exe	102
PID 4156 wrote to memory of 3468	4156	cmd.exe	104
PID 4156 wrote to memory of 3468	4156	cmd.exe	104
PID 3284 wrote to memory of 1232	3284	java.exe	107
PID 3284 wrote to memory of 1232	3284	java.exe	107
PID 1232 wrote to memory of 3436	1232	cmd.exe	109
PID 1232 wrote to memory of 3436	1232	cmd.exe	109
PID 3284 wrote to memory of 3376	3284	java.exe	110
PID 3284 wrote to memory of 3376	3284	java.exe	110
PID 1556 wrote to memory of 4712	1556	java.exe	112
PID 1556 wrote to memory of 4712	1556	java.exe	112
PID 4712 wrote to memory of 3532	4712	cmd.exe	114
PID 4712 wrote to memory of 3532	4712	cmd.exe	114
PID 1556 wrote to memory of 1740	1556	java.exe	115
PID 1556 wrote to memory of 1740	1556	java.exe	115
PID 1740 wrote to memory of 380	1740	cmd.exe	117
PID 1740 wrote to memory of 380	1740	cmd.exe	117
PID 1556 wrote to memory of 2836	1556	java.exe	118
PID 1556 wrote to memory of 2836	1556	java.exe	118
PID 3284 wrote to memory of 1248	3284	java.exe	121
PID 3284 wrote to memory of 1248	3284	java.exe	121
PID 3284 wrote to memory of 2204	3284	java.exe	123
PID 3284 wrote to memory of 2204	3284	java.exe	123
PID 3284 wrote to memory of 452	3284	java.exe	124
PID 3284 wrote to memory of 452	3284	java.exe	124
PID 452 wrote to memory of 3304	452	cmd.exe	127
PID 452 wrote to memory of 3304	452	cmd.exe	127
PID 3284 wrote to memory of 5076	3284	java.exe	129
PID 3284 wrote to memory of 5076	3284	java.exe	129
PID 3284 wrote to memory of 1396	3284	java.exe	131
PID 3284 wrote to memory of 1396	3284	java.exe	131
PID 3284 wrote to memory of 2548	3284	java.exe	135
PID 3284 wrote to memory of 2548	3284	java.exe	135
PID 3284 wrote to memory of 2412	3284	java.exe	137
PID 3284 wrote to memory of 2412	3284	java.exe	137
PID 3284 wrote to memory of 1904	3284	java.exe	139
PID 3284 wrote to memory of 1904	3284	java.exe	139
PID 3284 wrote to memory of 1548	3284	java.exe	141
PID 3284 wrote to memory of 1548	3284	java.exe	141
PID 3284 wrote to memory of 1172	3284	java.exe	143
PID 3284 wrote to memory of 1172	3284	java.exe	143
PID 3284 wrote to memory of 4852	3284	java.exe	145
PID 3284 wrote to memory of 4852	3284	java.exe	145
PID 3284 wrote to memory of 5100	3284	java.exe	147
PID 3284 wrote to memory of 5100	3284	java.exe	147
PID 3284 wrote to memory of 380	3284	java.exe	149
PID 3284 wrote to memory of 380	3284	java.exe	149
PID 3284 wrote to memory of 1216	3284	java.exe	151
PID 3284 wrote to memory of 1216	3284	java.exe	151
PID 3284 wrote to memory of 1792	3284	java.exe	153
PID 3284 wrote to memory of 1792	3284	java.exe	153
PID 3284 wrote to memory of 1628	3284	java.exe	155
PID 3284 wrote to memory of 1628	3284	java.exe	155
PID 3284 wrote to memory of 1708	3284	java.exe	157
PID 3284 wrote to memory of 1708	3284	java.exe	157
PID 3284 wrote to memory of 2940	3284	java.exe	159
PID 3284 wrote to memory of 2940	3284	java.exe	159
PID 3284 wrote to memory of 2144	3284	java.exe	161
PID 3284 wrote to memory of 2144	3284	java.exe	161

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\67579e48f13ac386cd90cfc23f7873ad_JaffaCakes118.jar
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4352
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.199857532008399848362580752398238657.class
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7469064719132213543.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7469064719132213543.vbs
      4⤵
      PID:3532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive9177601182087842398.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive9177601182087842398.vbs
      4⤵
      PID:380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:2836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8983409583674202588.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8983409583674202588.vbs
    3⤵
    PID:3468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6068758428458177684.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6068758428458177684.vbs
    3⤵
    PID:3436
- C:\Windows\SYSTEM32\xcopy.exe
  xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM UserAccountControlSettings.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\VIrAkPopHv5223468427381686906.reg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\regedit.exe
    regedit.exe /s C:\Users\Admin\AppData\Local\Temp\VIrAkPopHv5223468427381686906.reg
    3⤵
    - UAC bypass
    - Sets file execution options in registry
    - Runs .reg file with regedit
    PID:3304
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM ProcessHacker.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM procexp.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM MSASCui.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM MsMpEng.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM MpUXSrv.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM MpCmdRun.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM NisSrv.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM ConfigSecurityPolicy.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM procexp.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM wireshark.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM tshark.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM text2pcap.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM rawshark.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM mergecap.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM editcap.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM dumpcap.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM capinfos.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM mbam.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM mbamscheduler.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM mbamservice.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AdAwareService.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AdAwareTray.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM WebCompanion.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AdAwareDesktop.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM V3Main.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM V3Svc.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM V3Up.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM V3SP.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM V3Proxy.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM V3Medic.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM BgScan.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM BullGuard.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM BullGuardBhvScanner.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM BullGuarScanner.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM LittleHook.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM BullGuardUpdate.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM clamscan.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM ClamTray.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM ClamWin.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM cis.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM CisTray.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM cmdagent.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM cavwp.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM dragon_updater.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM MWAGENT.EXE /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM MWASER.EXE /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM CONSCTLX.EXE /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM avpmapp.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM econceal.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM escanmon.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM escanpro.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM TRAYSSER.EXE /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM TRAYICOS.EXE /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM econser.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM VIEWTCP.EXE /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM FSHDLL64.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM fsgk32.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM fshoster32.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM FSMA32.EXE /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM fsorsp.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM fssm32.exe /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM FSM32.EXE /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM trigger.exe /T /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM FProtTray.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4340
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM FPWin.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:404
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM FPAVServer.exe /T /F
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AVK.exe /T /F
  2⤵
  PID:3604
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM GdBgInx64.exe /T /F
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AVKProxy.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:1628
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM GDScan.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4216
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AVKWCtlx64.exe /T /F
  2⤵
  PID:1396
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AVKService.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3080
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AVKTray.exe /T /F
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM GDKBFltExe32.exe /T /F
  2⤵
  PID:3576
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM GDSC.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4280
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM virusutilities.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4440
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM guardxservice.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:748
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM guardxkickoff_x64.exe /T /F
  2⤵
  PID:556
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM iptray.exe /T /F
  2⤵
  PID:3436
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM freshclam.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:1316
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM freshclamwrap.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3964
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7RTScan.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4688
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7FWSrvc.exe /T /F
  2⤵
  PID:3516
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7PSSrvc.exe /T /F
  2⤵
  PID:2096
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7EmlPxy.EXE /T /F
  2⤵
  - Kills process with taskkill
  PID:4896
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7TSecurity.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4140
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7AVScan.exe /T /F
  2⤵
  PID:2536
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7CrvSvc.exe /T /F
  2⤵
  PID:3364
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7SysMon.Exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4368
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7TSMain.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3860
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7TSMngr.exe /T /F
  2⤵
  PID:1444
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nanosvc.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:1720
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nanoav.exe /T /F
  2⤵
  PID:2792
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nnf.exe /T /F
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nvcsvc.exe /T /F
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nbrowser.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3324
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nseupdatesvc.exe /T /F
  2⤵
  PID:2904
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nfservice.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3496
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nwscmon.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:2784
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM njeeves2.exe /T /F
  2⤵
  PID:2816
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nvcod.exe /T /F
  2⤵
  PID:5096
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nvoy.exe /T /F
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM zlhh.exe /T /F
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM Zlh.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4584
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM nprosec.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3604
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM Zanda.exe /T /F
  2⤵
  PID:2936
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM NS.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:1136
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM acs.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:1876
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM op_mon.exe /T /F
  2⤵
  PID:452
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM PSANHost.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4008
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM PSUAMain.exe /T /F
  2⤵
  PID:2272
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM PSUAService.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:404
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM AgentSvc.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:2176
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM BDSSVC.EXE /T /F
  2⤵
  PID:1396
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM EMLPROXY.EXE /T /F
  2⤵
  PID:2720
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM OPSSVC.EXE /T /F
  2⤵
  PID:1616
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM ONLINENT.EXE /T /F
  2⤵
  - Kills process with taskkill
  PID:3316
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM QUHLPSVC.EXE /T /F
  2⤵
  - Kills process with taskkill
  PID:232
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SAPISSVC.EXE /T /F
  2⤵
  PID:4060
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SCANNER.EXE /T /F
  2⤵
  PID:3548
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SCANWSCS.EXE /T /F
  2⤵
  PID:1252
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM scproxysrv.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:5112
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM ScSecSvc.exe /T /F
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SUPERAntiSpyware.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:2904
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SASCore64.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SSUpdate64.exe /T /F
  2⤵
  PID:4860
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SUPERDelete.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3868
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM SASTask.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:3628
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7RTScan.exe /T /F
  2⤵
  PID:4904
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7FWSrvc.exe /T /F
  2⤵
  PID:4504
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7PSSrvc.exe /T /F
  2⤵
  PID:2960
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7EmlPxy.EXE /T /F
  2⤵
  - Kills process with taskkill
  PID:1228
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7TSecurity.exe /T /F
  2⤵
  PID:4636
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7AVScan.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:4824
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7CrvSvc.exe /T /F
  2⤵
  PID:2416
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7SysMon.Exe /T /F
  2⤵
  PID:5036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7TSMain.exe /T /F
  2⤵
  PID:1648
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM K7TSMngr.exe /T /F
  2⤵
  PID:4548
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM uiWinMgr.exe /T /F
  2⤵
  - Kills process with taskkill
  PID:2120
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /IM uiWatchDog.exe /T /F
  2⤵
  PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3760,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 495a1535a9cce24cf1b1cc7a688337ff09d33d2de2651c4dd7884a0f13137dd8
MD5 098ae98916555fc1e5770e4dbc27cead
SHA1 ded1532feeb88def5e5d135931871f84e05582a5
SHA512 f140a15f75319e25b497345a7f7f5c4b2cf0f18316ed996bdefd0d7eb5a2b7982b5431304eeee5a7a2d4b83b20d6dedcfd73b16b28e17304fbdb975f1fa97392
MD5 SHA1 SHA512

Submit Download

Retrive6068758428458177684.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive6068758428458177684.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive8983409583674202588.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive8983409583674202588.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

VIrAkPopHv5223468427381686906.reg

Path C:\Users\Admin\AppData\Local\Temp\VIrAkPopHv5223468427381686906.reg
Size 27KB
SHA256 45497c7ca76f29c6786a8835bc1925a5f6cd219403dce807fb34b98a630212b3
MD5 22c27d345f6ceff99de5fe515991c4bf
SHA1 9c80dd9ffc77e2666281404f6452f5bd48d2bbcb
SHA512 6875b8b8c2c29860db7feb7afa95379d4ee1b027ba7f30547bb99c30bf11ffc7d69a914ab029d23c8ce2b2a36dffde5117e76ba639a6da9b349b62538740f773
SSDEEP 96:PJWwXczWquqtVciCtmtatLitmtJCtTt6tVtatNtgtitCtztHtxtMt8thtVRtTtsw:PqgrnuR0hTmEgGpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

_0.199857532008399848362580752398238657.class

Path C:\Users\Admin\AppData\Local\Temp\_0.199857532008399848362580752398238657.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_d2547453-e731-4fdf-8f92-95f955a44aca

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\83aa4cc77f591dfc2374580bbd95f6ba_d2547453-e731-4fdf-8f92-95f955a44aca
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages_zh_TW.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
MD5 SHA1 SHA512

Submit Download

win32_CopyNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Size 7KB
SHA256 84e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8
MD5 12f971b6e65cbc7184701235469f0339
SHA1 06cb165157c5e0078b872c48707a1328b1dcba19
SHA512 58646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de
SSDEEP 192:7W3/Oi76M94KjPIsmnOyxRDuQe80clILkwwGDrRZ7exi1O:7W3/Oi7NefiQeClIwG/jqKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path C:\Windows\System32\test.txt
Size 911B
SHA256 c2d5ccf856302f19cc9a58d4bb160571be308b97587816306b6ae05013feba2f
MD5 a7e01bd20a086b8f13eed5b3f27055ba
SHA1 3a017a4b1224f55d22985e4179d69eeb3f92d784
SHA512 fc6e07973f20e8400d22fc91cd007202a0f6dedcc4943751024a7fa5784684e9da8d693f398429449a6f45258f9544cc6fc4b040be2cfcc2506cec6502c9c3f7
MD5 SHA1 SHA512

Submit Download

memory/1556-320-0x000001CBC4190000-0x000001CBC4191000-memory.dmp

Download

memory/1556-986-0x000001CBC4190000-0x000001CBC4191000-memory.dmp

Download

memory/1556-1228-0x000001CBC4190000-0x000001CBC4191000-memory.dmp

Download

memory/1556-702-0x000001CBC4190000-0x000001CBC4191000-memory.dmp

Download

memory/1556-1245-0x000001CBC4190000-0x000001CBC4191000-memory.dmp

Download

memory/3284-108-0x000001E9C8040000-0x000001E9C8050000-memory.dmp

Download

memory/3284-122-0x000001E9C8090000-0x000001E9C80A0000-memory.dmp

Download

memory/3284-40-0x000001E9C7FD0000-0x000001E9C7FE0000-memory.dmp

Download

memory/3284-43-0x000001E9C7FE0000-0x000001E9C7FF0000-memory.dmp

Download

memory/3284-45-0x000001E9C7FF0000-0x000001E9C8000000-memory.dmp

Download

memory/3284-44-0x000001E9C7C90000-0x000001E9C7F00000-memory.dmp

Download

memory/3284-50-0x000001E9C7F00000-0x000001E9C7F10000-memory.dmp

Download

memory/3284-51-0x000001E9C8000000-0x000001E9C8010000-memory.dmp

Download

memory/3284-54-0x000001E9C7F10000-0x000001E9C7F20000-memory.dmp

Download

memory/3284-56-0x000001E9C8020000-0x000001E9C8030000-memory.dmp

Download

memory/3284-55-0x000001E9C8010000-0x000001E9C8020000-memory.dmp

Download

memory/3284-61-0x000001E9C8030000-0x000001E9C8040000-memory.dmp

Download

memory/3284-59-0x000001E9C7F30000-0x000001E9C7F40000-memory.dmp

Download

memory/3284-66-0x000001E9C7F60000-0x000001E9C7F70000-memory.dmp

Download

memory/3284-67-0x000001E9C8050000-0x000001E9C8060000-memory.dmp

Download

memory/3284-64-0x000001E9C7F50000-0x000001E9C7F60000-memory.dmp

Download

memory/3284-65-0x000001E9C8040000-0x000001E9C8050000-memory.dmp

Download

memory/3284-60-0x000001E9C7F40000-0x000001E9C7F50000-memory.dmp

Download

memory/3284-58-0x000001E9C7F20000-0x000001E9C7F30000-memory.dmp

Download

memory/3284-71-0x000001E9C7F80000-0x000001E9C7F90000-memory.dmp

Download

memory/3284-74-0x000001E9C8070000-0x000001E9C8080000-memory.dmp

Download

memory/3284-73-0x000001E9C8060000-0x000001E9C8070000-memory.dmp

Download

memory/3284-72-0x000001E9C7F90000-0x000001E9C7FA0000-memory.dmp

Download

memory/3284-70-0x000001E9C7F70000-0x000001E9C7F80000-memory.dmp

Download

memory/3284-76-0x000001E9C7FA0000-0x000001E9C7FB0000-memory.dmp

Download

memory/3284-79-0x000001E9C8080000-0x000001E9C8090000-memory.dmp

Download

memory/3284-78-0x000001E9C7FC0000-0x000001E9C7FD0000-memory.dmp

Download

memory/3284-77-0x000001E9C7FB0000-0x000001E9C7FC0000-memory.dmp

Download

memory/3284-82-0x000001E9C8090000-0x000001E9C80A0000-memory.dmp

Download

memory/3284-81-0x000001E9C7FD0000-0x000001E9C7FE0000-memory.dmp

Download

memory/3284-87-0x000001E9C80B0000-0x000001E9C80C0000-memory.dmp

Download

memory/3284-86-0x000001E9C80A0000-0x000001E9C80B0000-memory.dmp

Download

memory/3284-85-0x000001E9C7FE0000-0x000001E9C7FF0000-memory.dmp

Download

memory/3284-90-0x000001E9C80C0000-0x000001E9C80D0000-memory.dmp

Download

memory/3284-89-0x000001E9C7FF0000-0x000001E9C8000000-memory.dmp

Download

memory/3284-95-0x000001E9C80D0000-0x000001E9C80E0000-memory.dmp

Download

memory/3284-94-0x000001E9C8020000-0x000001E9C8030000-memory.dmp

Download

memory/3284-96-0x000001E9C80E0000-0x000001E9C80F0000-memory.dmp

Download

memory/3284-93-0x000001E9C8000000-0x000001E9C8010000-memory.dmp

Download

memory/3284-100-0x000001E9C8010000-0x000001E9C8020000-memory.dmp

Download

memory/3284-102-0x000001E9C8100000-0x000001E9C8110000-memory.dmp

Download

memory/3284-101-0x000001E9C80F0000-0x000001E9C8100000-memory.dmp

Download

memory/3284-105-0x000001E9C8030000-0x000001E9C8040000-memory.dmp

Download

memory/3284-106-0x000001E9C8110000-0x000001E9C8120000-memory.dmp

Download

memory/3284-38-0x000001E9C7FB0000-0x000001E9C7FC0000-memory.dmp

Download

memory/3284-109-0x000001E9C8120000-0x000001E9C8130000-memory.dmp

Download

memory/3284-111-0x000001E9C8050000-0x000001E9C8060000-memory.dmp

Download

memory/3284-112-0x000001E9C8130000-0x000001E9C8140000-memory.dmp

Download

memory/3284-115-0x000001E9C8060000-0x000001E9C8070000-memory.dmp

Download

memory/3284-119-0x000001E9C8080000-0x000001E9C8090000-memory.dmp

Download

memory/3284-118-0x000001E9C8150000-0x000001E9C8160000-memory.dmp

Download

memory/3284-117-0x000001E9C8140000-0x000001E9C8150000-memory.dmp

Download

memory/3284-116-0x000001E9C8070000-0x000001E9C8080000-memory.dmp

Download

memory/3284-37-0x000001E9C7FA0000-0x000001E9C7FB0000-memory.dmp

Download

memory/3284-124-0x000001E9C8170000-0x000001E9C8180000-memory.dmp

Download

memory/3284-123-0x000001E9C8160000-0x000001E9C8170000-memory.dmp

Download

memory/3284-129-0x000001E9C8180000-0x000001E9C8190000-memory.dmp

Download

memory/3284-128-0x000001E9C80B0000-0x000001E9C80C0000-memory.dmp

Download

memory/3284-127-0x000001E9C80A0000-0x000001E9C80B0000-memory.dmp

Download

memory/3284-137-0x000001E9C81B0000-0x000001E9C81C0000-memory.dmp

Download

memory/3284-136-0x000001E9C81A0000-0x000001E9C81B0000-memory.dmp

Download

memory/3284-145-0x000001E9C81E0000-0x000001E9C81F0000-memory.dmp

Download

memory/3284-149-0x000001E9C81F0000-0x000001E9C8200000-memory.dmp

Download

memory/3284-148-0x000001E9C8100000-0x000001E9C8110000-memory.dmp

Download

memory/3284-147-0x000001E9C80F0000-0x000001E9C8100000-memory.dmp

Download

memory/3284-154-0x000001E9C8210000-0x000001E9C8220000-memory.dmp

Download

memory/3284-153-0x000001E9C8200000-0x000001E9C8210000-memory.dmp

Download

memory/3284-152-0x000001E9C8110000-0x000001E9C8120000-memory.dmp

Download

memory/3284-144-0x000001E9C81D0000-0x000001E9C81E0000-memory.dmp

Download

memory/3284-143-0x000001E9C81C0000-0x000001E9C81D0000-memory.dmp

Download

memory/3284-142-0x000001E9C80E0000-0x000001E9C80F0000-memory.dmp

Download

memory/3284-141-0x000001E9C80D0000-0x000001E9C80E0000-memory.dmp

Download

memory/3284-135-0x000001E9C8190000-0x000001E9C81A0000-memory.dmp

Download

memory/3284-134-0x000001E9C80C0000-0x000001E9C80D0000-memory.dmp

Download

memory/3284-156-0x000001E9C8120000-0x000001E9C8130000-memory.dmp

Download

memory/3284-158-0x000001E9C8220000-0x000001E9C8230000-memory.dmp

Download

memory/3284-161-0x000001E9C8230000-0x000001E9C8240000-memory.dmp

Download

memory/3284-160-0x000001E9C8130000-0x000001E9C8140000-memory.dmp

Download

memory/3284-167-0x000001E9C8140000-0x000001E9C8150000-memory.dmp

Download

memory/3284-172-0x000001E9C8280000-0x000001E9C8290000-memory.dmp

Download

memory/3284-171-0x000001E9C8270000-0x000001E9C8280000-memory.dmp

Download

memory/3284-170-0x000001E9C8260000-0x000001E9C8270000-memory.dmp

Download

memory/3284-169-0x000001E9C8250000-0x000001E9C8260000-memory.dmp

Download

memory/3284-168-0x000001E9C8240000-0x000001E9C8250000-memory.dmp

Download

memory/3284-255-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-39-0x000001E9C7FC0000-0x000001E9C7FD0000-memory.dmp

Download

memory/3284-278-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-281-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-307-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-459-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-31-0x000001E9C7F70000-0x000001E9C7F80000-memory.dmp

Download

memory/3284-32-0x000001E9C7F80000-0x000001E9C7F90000-memory.dmp

Download

memory/3284-33-0x000001E9C7F90000-0x000001E9C7FA0000-memory.dmp

Download

memory/3284-26-0x000001E9C7F60000-0x000001E9C7F70000-memory.dmp

Download

memory/3284-24-0x000001E9C7F50000-0x000001E9C7F60000-memory.dmp

Download

memory/3284-20-0x000001E9C7F20000-0x000001E9C7F30000-memory.dmp

Download

memory/3284-21-0x000001E9C7F30000-0x000001E9C7F40000-memory.dmp

Download

memory/3284-22-0x000001E9C7F40000-0x000001E9C7F50000-memory.dmp

Download

memory/3284-17-0x000001E9C7F10000-0x000001E9C7F20000-memory.dmp

Download

memory/3284-14-0x000001E9C7F00000-0x000001E9C7F10000-memory.dmp

Download

memory/3284-1220-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-12-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-2-0x000001E9C7C90000-0x000001E9C7F00000-memory.dmp

Download

memory/3284-1251-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-1257-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

memory/3284-1252-0x000001E9C6650000-0x000001E9C6651000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads