adwind | 0b09172121446ef773c5a6b3e69054aa830d7d7f030b716674972c80717a65f8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
Size

4.4MB
MD5

9e9fec3ff4dce17a719345d12573d1a0
SHA1

9b00aac448f2578dbe3ad1fa6ad881dce088ee4f
SHA256

0b09172121446ef773c5a6b3e69054aa830d7d7f030b716674972c80717a65f8
SHA512

a40ba2f5fb8ba6dcb8f2013ac2b165ecb6d5d545da85531aa4d20a64e6577e2edd68c8dfecf1b7d9133ab2b62e99cd0ef6237d10fc76509c25b164038d37b651
SSDEEP

49152:BwCbthWW8/fe+sz1KDkfMSnvmc4+2ZnA2p2BUEfK5vbVQQb/ur2Z:5VQb6ZfMSvmFnBcBUE4baa/d

Score

10^/10

adwind hawkeye latentbot lokibot xtremerat collection discovery evasion keylogger persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

xtremerat

jasoiuuydealoo.zapto.org

Extracted

Family

latentbot

jasoiuuydealoo.zapto.org

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind
Class file contains resources related to AdWind 1 IoCs

Processes:

resource yara_rule

sample family_adwind5

resource	yara_rule
sample	family_adwind5

Detect XtremeRAT payload 23 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\server.exe	family_xtremerat
behavioral2/memory/1256-64-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1256-72-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4452-85-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4452-89-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1440-764-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1440-766-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1612-992-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1612-993-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4904-1059-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1248-1119-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1248-1122-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/3396-1140-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/3396-1146-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4440-1206-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4440-1208-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4412-1209-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4412-1210-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1788-1212-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1788-1220-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/4308-1233-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1256-1237-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat
behavioral2/memory/1256-1238-0x0000000000C80000-0x0000000000E66000-memory.dmp	family_xtremerat

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/5040-1098-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/5040-1098-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5040-1098-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Server.exeServer.exeserver.exeServer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{30638083-453S-68EO-4NQL-52T8070AA6GX}	Server.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDKBFltExe32.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scproxysrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWinMgr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BgScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYSSER.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff_x64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bav.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWASER.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDScan.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKService.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldCCC.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanpro.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSM32.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavUpdater.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldDS.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuarScanner.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCS-Uninstall.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utsvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserReg.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserReg.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fshoster32.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSSVC.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKProxy.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiUpdateTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANWSCS.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\debugger = "svchost.exe"	regedit.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Server.exe9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exeserver.exeServer.exeServer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 27 IoCs

Processes:

server.exe71naui.exe843yytr.exe735yreee.exeServer.exejavaw.exe843yytr.exejava.exe71naui.exe843yytr.exe735yreee.exe843yytr.exeServer.exe71naui.exe843yytr.exe735yreee.exe843yytr.exeServer.exe71naui.exe843yytr.exe735yreee.exe843yytr.exe735yreee.exe71naui.exe71naui.exe71naui.exe71naui.exe

pid	process
4904	server.exe
1072	71naui.exe
2212	843yytr.exe
2452	735yreee.exe
4308	Server.exe
1468	javaw.exe
5040	843yytr.exe
400	java.exe
3024	71naui.exe
4540	843yytr.exe
1636	735yreee.exe
940	843yytr.exe
4228	Server.exe
2028	71naui.exe
4796	843yytr.exe
1000	735yreee.exe
5108	843yytr.exe
1620	Server.exe
404	71naui.exe
1364	843yytr.exe
4752	735yreee.exe
1256	843yytr.exe
4888	735yreee.exe
2920	71naui.exe
5492	71naui.exe
5556	71naui.exe
5656	71naui.exe

Loads dropped DLL 24 IoCs

Processes:

javaw.exejava.exe

pid	process
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
1468	javaw.exe
400	java.exe
400	java.exe
400	java.exe
400	java.exe
1468	javaw.exe
400	java.exe
400	java.exe
400	java.exe
1468	javaw.exe
400	java.exe
400	java.exe
400	java.exe
400	java.exe
1468	javaw.exe
400	java.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2120 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2120	icacls.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3932-0-0x0000000000400000-0x000000000094F000-memory.dmp	upx
behavioral2/memory/3932-2-0x0000000000400000-0x000000000094F000-memory.dmp	upx
behavioral2/memory/3932-7-0x0000000000400000-0x000000000094F000-memory.dmp	upx
behavioral2/memory/3932-8-0x0000000000400000-0x000000000094F000-memory.dmp	upx
behavioral2/memory/3932-9-0x0000000000400000-0x000000000094F000-memory.dmp	upx
behavioral2/memory/3932-17-0x0000000000400000-0x000000000094F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\71naui.exe	upx
behavioral2/memory/1072-1012-0x0000000000400000-0x000000000052C000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\735yreee.exe	upx
behavioral2/memory/2452-1028-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/3024-1226-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/1636-1229-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/2028-1256-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/1072-1274-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/2452-1278-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/4752-1281-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/3024-1327-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/1636-1342-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/2028-1378-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/1000-1393-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/404-1412-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/4752-1421-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/2452-1438-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/1072-1442-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/1636-1536-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/3024-1541-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/1000-1570-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/2028-1573-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral2/memory/4752-1600-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/404-1607-0x0000000000400000-0x000000000052C000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

735yreee.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	735yreee.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	735yreee.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	735yreee.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

server.exeServer.exe735yreee.exeServer.exe843yytr.exeServer.exe735yreee.exe735yreee.exereg.exe735yreee.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	735yreee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	843yytr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	735yreee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	735yreee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ndSXEDTKLJo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\ggbKxAcpycv\\dGCSCXrklBR.SDaLTg\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	735yreee.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

843yytr.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini 843yytr.exe
File opened for modification C:\Windows\assembly\Desktop.ini 843yytr.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 whatismyipaddress.com

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	843yytr.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	843yytr.exe

flow	ioc
12	whatismyipaddress.com

Drops file in System32 directory 3 IoCs

Processes:

javaw.exejavaw.exejava.exe

description	ioc	process
File created	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Suspicious use of SetThreadContext 15 IoCs

Processes:

9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe843yytr.exe843yytr.exe843yytr.exe843yytr.exe843yytr.exe735yreee.exe71naui.exe735yreee.exe71naui.exe735yreee.exe71naui.exe735yreee.exe71naui.exe

description	pid	process	target process
PID 3932 set thread context of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 2212 set thread context of 5040	2212	843yytr.exe	843yytr.exe
PID 4540 set thread context of 940	4540	843yytr.exe	843yytr.exe
PID 4796 set thread context of 5108	4796	843yytr.exe	843yytr.exe
PID 5040 set thread context of 1652	5040	843yytr.exe	vbc.exe
PID 1364 set thread context of 1256	1364	843yytr.exe	843yytr.exe
PID 5040 set thread context of 4776	5040	843yytr.exe	vbc.exe
PID 2452 set thread context of 4888	2452	735yreee.exe	735yreee.exe
PID 1072 set thread context of 2920	1072	71naui.exe	71naui.exe
PID 1636 set thread context of 0	1636	735yreee.exe
PID 3024 set thread context of 5492	3024	71naui.exe	71naui.exe
PID 1000 set thread context of 0	1000	735yreee.exe
PID 2028 set thread context of 5556	2028	71naui.exe	71naui.exe
PID 4752 set thread context of 0	4752	735yreee.exe
PID 404 set thread context of 5656	404	71naui.exe	71naui.exe

Drops file in Windows directory 12 IoCs

Processes:

843yytr.exeServer.exeServer.exeServer.exeserver.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	843yytr.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File created	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\	server.exe
File created	C:\Windows\assembly\Desktop.ini	843yytr.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	843yytr.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 62 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2724	taskkill.exe
5624	taskkill.exe
4576	taskkill.exe
2768	taskkill.exe
2944	taskkill.exe
4872	taskkill.exe
5164	taskkill.exe
4444	taskkill.exe
3496	taskkill.exe
1768	taskkill.exe
2944	taskkill.exe
1056	taskkill.exe
468	taskkill.exe
2400	taskkill.exe
3036	taskkill.exe
1876	taskkill.exe
5716	taskkill.exe
1224	taskkill.exe
3020	taskkill.exe
3604	taskkill.exe
4796	taskkill.exe
528	taskkill.exe
4556	taskkill.exe
2096	taskkill.exe
1944	taskkill.exe
4356	taskkill.exe
5604	taskkill.exe
5180	taskkill.exe
3736	taskkill.exe
2444	taskkill.exe
1076	taskkill.exe
3312	taskkill.exe
2836	taskkill.exe
4820	taskkill.exe
2848	taskkill.exe
1464	taskkill.exe
1672	taskkill.exe
680	taskkill.exe
3520	taskkill.exe
5244	taskkill.exe
5988	taskkill.exe
1056	taskkill.exe
6032	taskkill.exe
6072	taskkill.exe
2784	taskkill.exe
228	taskkill.exe
5948	taskkill.exe
644	taskkill.exe
4888	taskkill.exe
5476	taskkill.exe
1056	taskkill.exe
2804	taskkill.exe
3208	taskkill.exe
2768	taskkill.exe
1300	taskkill.exe
2508	taskkill.exe
1612	taskkill.exe
3600	taskkill.exe
5368	taskkill.exe
2552	taskkill.exe
3284	taskkill.exe
3064	taskkill.exe

Modifies registry class 4 IoCs

Processes:

9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exeserver.exeServer.exeServer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Server.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3408 reg.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3676 regedit.exe

pid	process
3408	reg.exe

pid	process
3676	regedit.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

843yytr.exe843yytr.exe843yytr.exe843yytr.exe843yytr.exevbc.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
2212	843yytr.exe
4540	843yytr.exe
4540	843yytr.exe
4796	843yytr.exe
4796	843yytr.exe
5040	843yytr.exe
5040	843yytr.exe
1364	843yytr.exe
1364	843yytr.exe
4776	vbc.exe
4776	vbc.exe
2212	msedge.exe
2212	msedge.exe
5068	msedge.exe
5068	msedge.exe
5248	identity_helper.exe
5248	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

Server.exe

pid process

1620 Server.exe

pid	process
1620	Server.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

843yytr.exetaskkill.exe843yytr.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe843yytr.exetaskkill.exetaskkill.exe843yytr.exetaskkill.exetaskkill.exetaskkill.exe843yytr.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe735yreee.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2212	843yytr.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	4540	843yytr.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	4820	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	4796	843yytr.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	5040	843yytr.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	1364	843yytr.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	644	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	2508	taskkill.exe
Token: SeDebugPrivilege	2848	taskkill.exe
Token: SeDebugPrivilege	3604	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	4888	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	2096	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	3284	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	528	taskkill.exe
Token: SeDebugPrivilege	1876	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	3496	taskkill.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	4888	735yreee.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	5164	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	5716	taskkill.exe
Token: SeDebugPrivilege	6032	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	5368	taskkill.exe
Token: SeDebugPrivilege	5180	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

javaw.exejava.exejavaw.exejava.exe843yytr.exeServer.exe

pid process

840 javaw.exe
1664 java.exe
1468 javaw.exe
400 java.exe
5040 843yytr.exe
1620 Server.exe

pid	process
840	javaw.exe
1664	java.exe
1468	javaw.exe
400	java.exe
5040	843yytr.exe
1620	Server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exejavaw.exeserver.execmd.exejava.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3932 wrote to memory of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 3932 wrote to memory of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 3932 wrote to memory of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 3932 wrote to memory of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 3932 wrote to memory of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 3932 wrote to memory of 1544	3932	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
PID 1544 wrote to memory of 4904	1544	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	server.exe
PID 1544 wrote to memory of 4904	1544	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	server.exe
PID 1544 wrote to memory of 4904	1544	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	server.exe
PID 1544 wrote to memory of 840	1544	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	javaw.exe
PID 1544 wrote to memory of 840	1544	9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe	javaw.exe
PID 840 wrote to memory of 2120	840	javaw.exe	icacls.exe
PID 840 wrote to memory of 2120	840	javaw.exe	icacls.exe
PID 840 wrote to memory of 1664	840	javaw.exe	java.exe
PID 840 wrote to memory of 1664	840	javaw.exe	java.exe
PID 4904 wrote to memory of 4312	4904	server.exe	svchost.exe
PID 4904 wrote to memory of 4312	4904	server.exe	svchost.exe
PID 4904 wrote to memory of 4312	4904	server.exe	svchost.exe
PID 4904 wrote to memory of 3444	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 3444	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 1256	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 1256	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 1256	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 1256	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 3036	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 3036	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 4452	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 4452	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 4452	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 4452	4904	server.exe	explorer.exe
PID 840 wrote to memory of 1392	840	javaw.exe	cmd.exe
PID 840 wrote to memory of 1392	840	javaw.exe	cmd.exe
PID 1392 wrote to memory of 3484	1392	cmd.exe	cscript.exe
PID 1392 wrote to memory of 3484	1392	cmd.exe	cscript.exe
PID 4904 wrote to memory of 1580	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 1580	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 1524	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 1524	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 1524	4904	server.exe	explorer.exe
PID 1664 wrote to memory of 4272	1664	java.exe	cmd.exe
PID 1664 wrote to memory of 4272	1664	java.exe	cmd.exe
PID 4272 wrote to memory of 1328	4272	cmd.exe	cscript.exe
PID 4272 wrote to memory of 1328	4272	cmd.exe	cscript.exe
PID 840 wrote to memory of 2096	840	javaw.exe	cmd.exe
PID 840 wrote to memory of 2096	840	javaw.exe	cmd.exe
PID 1664 wrote to memory of 4832	1664	java.exe	cmd.exe
PID 1664 wrote to memory of 4832	1664	java.exe	cmd.exe
PID 2096 wrote to memory of 3968	2096	cmd.exe	cscript.exe
PID 2096 wrote to memory of 3968	2096	cmd.exe	cscript.exe
PID 4832 wrote to memory of 3288	4832	cmd.exe	cscript.exe
PID 4832 wrote to memory of 3288	4832	cmd.exe	cscript.exe
PID 840 wrote to memory of 1096	840	javaw.exe	xcopy.exe
PID 840 wrote to memory of 1096	840	javaw.exe	xcopy.exe
PID 1664 wrote to memory of 2176	1664	java.exe	xcopy.exe
PID 1664 wrote to memory of 2176	1664	java.exe	xcopy.exe
PID 4904 wrote to memory of 2140	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 2140	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 4588	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 4588	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 4588	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 3224	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 3224	4904	server.exe	msedge.exe
PID 4904 wrote to memory of 5104	4904	server.exe	explorer.exe
PID 4904 wrote to memory of 5104	4904	server.exe	explorer.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2524 attrib.exe
1944 attrib.exe

pid	process
2524	attrib.exe
1944	attrib.exe

outlook_office_path 1 IoCs

Processes:

735yreee.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	735yreee.exe

outlook_win_path 1 IoCs

Processes:

735yreee.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	735yreee.exe

C:\Users\Admin\AppData\Local\Temp\9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932

C:\Users\Admin\AppData\Local\Temp\9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e9fec3ff4dce17a719345d12573d1a0_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
3⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\svchost.exe
svchost.exe
4⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:3444

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:3036

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:1580

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:2140

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:3224

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:872

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:3748

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:1224

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:4864

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:3940

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:852

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:8

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1072

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
5⤵
- Executes dropped EXE
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=71naui.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf51846f8,0x7ffdf5184708,0x7ffdf5184718
7⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
7⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
7⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
7⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
7⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
7⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
7⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 /prefetch:8
7⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 /prefetch:8
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
7⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
7⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
7⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
7⤵
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
7⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
7⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
7⤵
PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
7⤵
PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
7⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17193634829932610378,8250273448271123368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
7⤵
PID:5892

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5040

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
6⤵
- Accesses Microsoft Outlook accounts
PID:1652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776

C:\Users\Admin\AppData\Local\Temp\735yreee.exe
"C:\Users\Admin\AppData\Local\Temp\735yreee.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2452

C:\Users\Admin\AppData\Local\Temp\735yreee.exe
"C:\Users\Admin\AppData\Local\Temp\735yreee.exe"
5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4888

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
4⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:4308

C:\Windows\SysWOW64\svchost.exe
svchost.exe
5⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:916

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:4852

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:1660

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:3380

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:2124

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:348

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:5000

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:4776

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:2528

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:1584

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3024

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
6⤵
- Executes dropped EXE
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=71naui.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
7⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf51846f8,0x7ffdf5184708,0x7ffdf5184718
8⤵
PID:5844

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
6⤵
- Executes dropped EXE
PID:940

C:\Users\Admin\AppData\Local\Temp\735yreee.exe
"C:\Users\Admin\AppData\Local\Temp\735yreee.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1636

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
5⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:4228

C:\Windows\SysWOW64\svchost.exe
svchost.exe
6⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:5068

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4644

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:632

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3840

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:432

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:2540

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:2488

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:116

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4296

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:1572

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2028

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
7⤵
- Executes dropped EXE
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=71naui.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
8⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffdf51846f8,0x7ffdf5184708,0x7ffdf5184718
9⤵
PID:5668

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
7⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Local\Temp\735yreee.exe
"C:\Users\Admin\AppData\Local\Temp\735yreee.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1000

C:\Windows\InstallDir\Server.exe
"C:\Windows\InstallDir\Server.exe"
6⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Windows\SysWOW64\svchost.exe
svchost.exe
7⤵
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2208

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2008

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:3676

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:4924

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:3220

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:5104

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:4464

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2172

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:748

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2016

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2436

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
7⤵
PID:2416

C:\Windows\SysWOW64\explorer.exe
explorer.exe
7⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:404

C:\Users\Admin\AppData\Local\Temp\71naui.exe
"C:\Users\Admin\AppData\Local\Temp\71naui.exe"
8⤵
- Executes dropped EXE
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=71naui.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
9⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf51846f8,0x7ffdf5184708,0x7ffdf5184718
10⤵
PID:5660

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Users\Admin\AppData\Local\Temp\843yytr.exe
"C:\Users\Admin\AppData\Local\Temp\843yytr.exe"
8⤵
- Executes dropped EXE
PID:1256

C:\Users\Admin\AppData\Local\Temp\735yreee.exe
"C:\Users\Admin\AppData\Local\Temp\735yreee.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4752

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\ulio.jar"
3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
4⤵
- Modifies file permissions
PID:2120

C:\Program Files\Java\jre-1.8\bin\java.exe
"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.924113746535397766913972974640947.class
4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3629778896966321108.vbs
5⤵
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3629778896966321108.vbs
6⤵
PID:1328

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3120378668717549195.vbs
5⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3120378668717549195.vbs
6⤵
PID:3288

C:\Windows\SYSTEM32\xcopy.exe
xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
5⤵
PID:2176

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4448895768603055568.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4448895768603055568.vbs
5⤵
PID:3484

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6707541306840975888.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6707541306840975888.vbs
5⤵
PID:3968

C:\Windows\SYSTEM32\xcopy.exe
xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
4⤵
PID:1096

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
4⤵
PID:5000

C:\Windows\SYSTEM32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ndSXEDTKLJo /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\ggbKxAcpycv\dGCSCXrklBR.SDaLTg\"" /f
4⤵
- Adds Run key to start application
- Modifies registry key
PID:3408

C:\Windows\SYSTEM32\attrib.exe
attrib +h "C:\Users\Admin\ggbKxAcpycv\*.*"
4⤵
- Views/modifies file attributes
PID:2524

C:\Windows\SYSTEM32\attrib.exe
attrib +h "C:\Users\Admin\ggbKxAcpycv"
4⤵
- Views/modifies file attributes
PID:1944

C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\ggbKxAcpycv\dGCSCXrklBR.SDaLTg
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.071429017098850862846569530569545708.class
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:400

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive994865266528627673.vbs
6⤵
PID:4904

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive994865266528627673.vbs
7⤵
PID:4104

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2289069528889226499.vbs
6⤵
PID:3764

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2289069528889226499.vbs
7⤵
PID:1096

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
6⤵
PID:4752

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7864988827916465790.vbs
5⤵
PID:1400

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7864988827916465790.vbs
6⤵
PID:5072

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4569373699109937596.vbs
5⤵
PID:1640

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4569373699109937596.vbs
6⤵
PID:872

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
5⤵
PID:3912

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM UserAccountControlSettings.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\CncUngSnNr1044670046496930225.reg
5⤵
PID:1060

C:\Windows\regedit.exe
regedit.exe /s C:\Users\Admin\AppData\Local\Temp\CncUngSnNr1044670046496930225.reg
6⤵
- UAC bypass
- Sets file execution options in registry
- Runs .reg file with regedit
PID:3676

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM Taskmgr.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ProcessHacker.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM procexp.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MSASCui.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MsMpEng.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MpUXSrv.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MpCmdRun.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM NisSrv.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ConfigSecurityPolicy.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM procexp.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM wireshark.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM tshark.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM text2pcap.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM rawshark.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mergecap.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM editcap.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM dumpcap.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM capinfos.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mbam.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mbamscheduler.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM mbamservice.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AdAwareService.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AdAwareTray.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM WebCompanion.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM AdAwareDesktop.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Main.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Svc.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Up.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3SP.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Proxy.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM V3Medic.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BgScan.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuard.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuardBhvScanner.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuarScanner.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM LittleHook.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM BullGuardUpdate.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM clamscan.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ClamTray.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM ClamWin.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM cis.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM CisTray.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM cmdagent.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM cavwp.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM dragon_updater.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5164

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MWAGENT.EXE /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM MWASER.EXE /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM CONSCTLX.EXE /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM avpmapp.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM econceal.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM escanmon.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM escanpro.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM TRAYSSER.EXE /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM TRAYICOS.EXE /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM econser.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM VIEWTCP.EXE /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FSHDLL64.exe /T /F
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fsgk32.exe /T /F
5⤵
- Kills process with taskkill
PID:5948

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fshoster32.exe /T /F
5⤵
- Kills process with taskkill
PID:5244

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM FSMA32.EXE /T /F
5⤵
- Kills process with taskkill
PID:6072

C:\Windows\SYSTEM32\taskkill.exe
taskkill /IM fsorsp.exe /T /F
5⤵
- Kills process with taskkill
PID:5988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
75fff2ab5633bef9914db74542d18b99

SHA1
620086b716a14342f8014ed07e21bd9fa9431fb4

SHA256
66177ed890ca5cfead5358754d1408b107f87c5a0ef72466519ac57e9f85fdd0

SHA512
96aa9b869b52b54dfdc4a93f55a22bd7aaa05b2e6bc3f44c189d59b0b52a49ac373722ee528942f3930946f9dd0733d5673eeb720cc8b1c2c5a91540778d3619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9c431dade6d73223fe2eb9ee7193cb3

SHA1
17af929ea23962055be1cb87d170f07eb4c1f14d

SHA256
a750ff2f0135dbf878c904c5a7ae04a291903a80092f9bd72d7a7b678d741071

SHA512
2798429bbfd4528a00b99a6bcdf9e2742d5b16c1b9d2b9395fe7bd382ccb9720e713549e9a73d00dde6e82d4b83528c918cebb4ed849fbc423df6be0c6fcc7a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64fa4dc545b8ee1629960a42fd5cf883

SHA1
c0aa8ab146f026d85a64bf5f82f92233e1556f8c

SHA256
166a7e33af28a479266052804d1fae60751c228a1502c9a83488fe70aff5dc3f

SHA512
a411a609610c77f1f90a5cec3b462213c63cfd4f71d64dff3fb3c33f713a83a5bc49b754a0e9d65202d210bc173ea25e82e2d5fea65142aacda52598849dd55a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d578feba8e148b0cde062d6b7de33e15

SHA1
6a0104dacc2c32a0eddc330c9a77bb891f5e9c7b

SHA256
6902164a44d3df747777ed5ed78f2cd89eefc29c65e930cea1d7c18c0851cf30

SHA512
b5079ede1ed79e6b9a4eae387ac9368182ec6e69c68520cc22b66d9669e379e0a76b1d494c89b2b2b26392e4fd5e517db812773b59c2110a73d00e397e1a097b

Download Submit
C:\Users\Admin\AppData\Local\Temp\71naui.exe

Filesize
670KB

MD5
e450429b58884b08b4507528669bc0fd

SHA1
c55ab7a1f5ebb7808019a5bdf5f2d5acc73f45ea

SHA256
d3409d112030a48f28388b2b493a8b9a603848027aff2a9cb2ab0b87eb4d0467

SHA512
4fb9fcc0724f3a987e152fbb0488829c1ea8b34273e0f341516759d93dd72f39091cdd9d52d34147ad76fee490e3e5014d4cf1ec06a34dbc7e184b743e7357f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\735yreee.exe

Filesize
495KB

MD5
2c99b89c8fa03b39f43338de99ac5175

SHA1
d7f3334b6df1d75f41b6f58ed9a48a6672cad501

SHA256
b8e1622ceaecb3acd31be2bc6f9b680def7a6b85302ae9bfe3db8e2e9f3430fe

SHA512
66ec46d70be43a4bc9a0e8a5d2aca603d07edb5a7220eac1af8a5fd56b830e77113f282a016a5713e3342da4121bd65171902a1b73093b77945623dc05bbfcd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\843yytr.exe

Filesize
679KB

MD5
83eafae0d4e4add1eb241bc3f093cd3d

SHA1
c4a7fa2c1734fecb7ab282b9f12101ad342c5575

SHA256
8c4631dd0eba8c9959524ba27e4c64b036acbb423055ce800c80d4cb64222f26

SHA512
215605aa13be26a28ba8e7406acf8f5bdb70022afcbacabe0d6333edb91332fd41a5ad881f31776fd71114be916d9355fdb7d8f7fbb3110bc8bfd022f52ceb7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\843yytr.exe.exe

Filesize
4B

MD5
a2ce4c7b743725199da04033b5b57469

SHA1
1ae348eafa097ab898941eafe912d711a407da10

SHA256
0fff86057dcfb3975c8bc44459740ba5ffb43551931163538df3f39a6bb991bc

SHA512
23bd59f57b16cd496b550c1bba09eb3f9a9dfe764ea03470e3cc43e4d0b4ca415d239772e4a9b930749e88cead9a7ec4b0a77d0dd310e61d8c6521ae6ff278b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive4448895768603055568.vbs

Filesize
276B

MD5
3bdfd33017806b85949b6faa7d4b98e4

SHA1
f92844fee69ef98db6e68931adfaa9a0a0f8ce66

SHA256
9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

SHA512
ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive6707541306840975888.vbs

Filesize
281B

MD5
a32c109297ed1ca155598cd295c26611

SHA1
dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

SHA256
45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

SHA512
70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.924113746535397766913972974640947.class

Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
1.9MB

MD5
b7614ad0d6a765a048e3f13c2dfa913c

SHA1
2d7b55787841054cad223be5ab715106596e0bd1

SHA256
7d5c3becc624d1c103837a5eaeb7c78136efbe2790e85c5655a60864ed7ffca0

SHA512
05cb6026a24504a1ba6a8c0b3d74a1449f66bd74fb293605db9904a903f4cb0a3749fc184b52f288512fa0f7314078d987356b795a2eb93557fbc7220638b026

Download Submit
C:\Users\Admin\AppData\Local\Temp\ulio.jar

Filesize
479KB

MD5
66d457f0a75fd5477348a25ade64971f

SHA1
4452ba3fe46398209562f1fcdcf4d3f8b76ae155

SHA256
7998702a25ae5ac15d4ab6e45409a68e84ec27712bc2c45caeac109ed59b12e1

SHA512
b7d5fa003bf17933f8e800eb12398580ad6d4e5a1a885118e7ca19d085642f0b555d4d34f3ec9e1d094b06947cad5d4e5d6db68039e814e1e7838c510a9d6610

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\83aa4cc77f591dfc2374580bbd95f6ba_310807ab-751f-4d81-ae09-b202eaf21e19

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\cFyJH45j.cfg

Filesize
6KB

MD5
5db4d454c376293183937e9b4f020d27

SHA1
6457871826d1bf1f7c9bd954502294b2f1424626

SHA256
8058933274a6100d21a3eed7dca23ee921cf5398ccdc51e18ddbe85e5f9866d9

SHA512
f56321776bece5b9172c9b79bcab437f2e50db278f97848b41dc480631af565a80c94afed56b9bbcb083e30b09c3e74d3cdc13b2420da5aae8a69a295ca60f2e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Filesize
162KB

MD5
583e8b42864ec183c945164f373cb375

SHA1
5ec118befbb5d17593a05db2899ee52f7267da37

SHA256
9bc9178d3f4246433fe209a0f5ca70e77568e80c928268c78f8c8b00107ce6ed

SHA512
1feaac37bac19bde93171ebda2e76a65e9d5472a503b05939f6977b3a4d94d131298f3989dd048d7617ecd69cf09db7ac986fc39f0df9f56c84ea01726d0c898

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

Filesize
285KB

MD5
1562e15220d8771fcb11b9a5b234a970

SHA1
50ec8e4e7125bda147a1b2ccc2b2827db2dc3479

SHA256
366199821c1efede3f7112d21da045fd6bf38b56fb3da1ae9d6493c4ddc1861f

SHA512
a07873f0a5381d202a6439a3245dd51f405cdcec4a9d40ff6ffdd4670a3b218008f7288a89e2a7455782c677d4c661bda96e62f813ce7d8c1f20a6c4c7c2b31f

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

Filesize
285KB

MD5
122e34bfa3146ef9ae5a51fdc744353f

SHA1
f0cc2294fe150a4cceca8a3da8615edcc4eb20e4

SHA256
dd2169db3358ccdf4a4a185e4a22955c989eaa3b9d3e0e6025599b8fa173c968

SHA512
306341e00598f02a70d3edc6ef666cb64982f1e31e5c0a1304977a1700c95395c1c7f0857ae8056853370eced0bd2aeafc72da804a65f98c1422929b7c431700

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Filesize
104KB

MD5
818fc60312c5ef0010e1a0367019005c

SHA1
bec6ce9b8330bd90c6f0527aa01871ec6b2ab018

SHA256
b090636931f9b5767c2a2c82ca4e5efbf65ce1a79630b48dea47ed01e1d81988

SHA512
43339d3407aaf85fa94aa3ff22ed3f457b29c93403a7ea19abbec50d4b5fee14fd415e70ac856a84c76530571a5a03eb8c5eae558edad6a64fcc3a3755dc3d5c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Filesize
66KB

MD5
4c8dbf6bb8438a43adecb07b90ec37d4

SHA1
d33ac1a59b79a8894f0225eca238b6c40649145b

SHA256
35b203dbdf6716bd7e35a66127acb5ae7d869388ee3778e8a956d1b54bfd15a1

SHA512
fc08a1390c87fb077758887cd89acec0326ac5332cb380771d8d0edd9e810c8e7fad43ad5800577307cad4ffb3007266d5cf56c7c726bac3939d908ac86eff8f

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll

Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll

Filesize
95KB

MD5
7415c1cc63a0c46983e2a32581daefee

SHA1
5f8534d79c84ac45ad09b5a702c8c5c288eae240

SHA256
475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

SHA512
3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll

Filesize
36KB

MD5
fcda37abd3d9e9d8170cd1cd15bf9d3f

SHA1
b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

SHA256
0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

SHA512
de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Filesize
8.5MB

MD5
36e3e370db5f0b66689811b41f1a8445

SHA1
7fcbe290c3a6a0827b77af78115a1b4bc834d685

SHA256
9f28a06990d2ed1d14130072109e37e733b3a7d4922e325e679dd4d917741550

SHA512
f93bc4ca946e383ee1edfef3c7b5574585d23d660a4cc3db5b6b203f6111a3fe1f245d583ca53852888ac67812fb6efd0d121d0643180875baeb0d7b811d4db9

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Filesize
142KB

MD5
fd3dcda8909ec5575b3b0acf6f219585

SHA1
4ae6dc79730e54231ff1f970515e3a16a4287fa6

SHA256
f70ceddab71854c9c59f412cec6be5d6b918a1b2ee23f7952354a00b71cc407a

SHA512
16b24f09943b7b92a92adfbdac6a274147e9eb54eae5a2d24eb07129dfced0b9b4f2ddaff6cf3e21c295af99f4b676be9084d72a1493d6c3cba9c91535a4bfb5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Filesize
55KB

MD5
0fcda2fc9a161614e68d74f4d9eecc2d

SHA1
d3734149ff561209aa9e851ea958012e20ce41da

SHA256
b1cf5a699d1a48691c2fe8dfad1c8c8aa1c4013c52b4107bad905faf037ddffa

SHA512
5402af47558721f084f5f05264e160bd43ebe265c2d2e3b415c2a0ea7bf9adf7aebb76e2c12dcf93ae5bf10d00f4c80aa3a97f35c02eb3279df9c675f3a037bc

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Filesize
87KB

MD5
2ca64779a19ba733a408edd9511b7c37

SHA1
99ad8571bc8cd48efba19a48066c0f0dd321ecc1

SHA256
c3c3365932d865e111972184ae12dc3853dc7e5d6df2f474dbeee5faead92cd3

SHA512
0822bb0e4d18115d325f3981ad15cb036d5a9f845d2c68975c5e9164b5fbdab0fdd4e882d3b8001f58271b7b38cba9bdc1299ccfab00ce0321f396aa8bf248a5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

Filesize
634B

MD5
499f2a4e0a25a41c1ff80df2d073e4fd

SHA1
e2469cbe07e92d817637be4e889ebb74c3c46253

SHA256
80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

SHA512
7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar

Filesize
2.9MB

MD5
a5b8d1a15884d8450ec905fc08d6e1d2

SHA1
472cdfe3f3bf1e719e3bc73f008f26960d2a74fc

SHA256
94e16e5ba8033fc3cd2a2e731b6326958dfe7c9b70fd4826eb2c0709a656d83d

SHA512
3eee8ff3e969161d551903a1687db379f516ddfe4bec35c508964012a58895a45a36d4efcd06a60448f3ec764c4f3dd7e317445c32e23b8c888b68361747e330

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties

Filesize
3KB

MD5
880baacb176553deab39edbe4b74380d

SHA1
37a57aad121c14c25e149206179728fa62203bf0

SHA256
ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

SHA512
3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index

Filesize
1KB

MD5
af03d781ec85caa0f45e6e29830ce112

SHA1
ef3dd2f731903182e47cb83cdf275f5f0e58b3db

SHA256
8c55ed28260fcd7fd4e5d68e871a735148c01a711545602c2c26aa9d6653c05c

SHA512
df080f8c206ba125f5ce4129640fc05e9fc5b00fd87fe08866bbc7b67f5caa3ec2792dd874d49253a70ea0a9c3856c2e8ba4c39728656854a290cfdf6ba683a3

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar

Filesize
46KB

MD5
5aff6406c285d0ef2e8d7946b2eb01f8

SHA1
fef27bfeff7242ea820c90665d684fcacd770505

SHA256
6507274374d7d50eb6bf5998288760988deccc16ed7934ad8a182c2500f0405c

SHA512
c94f1b7d30d74914ed973892f8f3200a20206caeec41e99feef9b58b9e4354260b396eb464e2162d740315f000d7bd1c811ef7520301fdc65dcfd0af648deb65

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar

Filesize
288KB

MD5
d48c3b0a549c1b0a72cc5bc63a4cc979

SHA1
542d860693da662555cea10986e533e374b52326

SHA256
a5d33f76829de19bd1eef234cf148c1f984707480befa81b4811bad21886a050

SHA512
f8f8e949bfc809a8504d810ceb4e75aad27008aba9aba27bc84dba77ebb7c05f8dc7f8a33b83d51d0872f9ce43ede3f26a51e9fc8eb17558c72b684c2bed73d6

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar

Filesize
120KB

MD5
99247d1d5370a784e438416e599abe36

SHA1
2f958cccadeb2d991e41edccece08bc1a64368cf

SHA256
f5700ffd6842bff801307c09e02ce3ca9792eb2cd4d34e79563bf77ff44ae531

SHA512
e3380e411f1b7219df659cbb4691cf3cd23c66f4af428f3b71539e579b6c2ce8209fad949f3909337a89282fd5c1d1eacf2a1acc34ff129c69c7b0bdb1b65a35

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar

Filesize
566KB

MD5
9868c5f7a74f603107ecdb43a367d91b

SHA1
6b5499786196c71c7c2ff63d1f15d70b4c0164a8

SHA256
8660a4dd44225c06a79afb5e8015a74cd610c50c777b4b2737008d179b69dd83

SHA512
1740c646cc0b83398ff0aa6c7b297cd4882840c9cae28fbac4914617764cc21c2026539b7eaf9209fff8d3b1df89a09299021f43910c07e434060434461daa8e

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar

Filesize
1.7MB

MD5
6b4188fce8bf2334732741b2f3c3c864

SHA1
95dfc9d9709f9b6e7fce99bc02a3bc7d1fde75d8

SHA256
46599d42d2c0b9bc6484a5b2d5a53bb5d9b238bef9c87f006acd61cc52bdb0ff

SHA512
59cbc0820e01fcf7a62675aa9bece9afd2ca20c3cca4b7033394c398e669b0b7f7ec5ac97486fecfb6fa48187b7faa0fb1fb5987e93c6a0a5e85e99b9ddda590

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

Filesize
2KB

MD5
689c0cbde7697f43642bf1134f4b70af

SHA1
307db1c4a9570f01479dea98f6b5bd33a1deb759

SHA256
6bd7ea02b9456a3730755e76d4ee1ccc04c524e93366cd74d7f42ac628d4ec77

SHA512
13afe0797d9c2c7ab8721fbedab42225b41f45059a9167c046a11e1bf6e03ad82accaed42884dff335b66ec41d3608d0d0bd06582af51634a81550c81baff2fb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar

Filesize
3.4MB

MD5
181737fb6fbc7447670c89c22262199c

SHA1
11150f5ba9782d8550fd1a3d6eee889a0ca66da0

SHA256
9dafdd0afd9f6aab6eec3f130d0c85bf5507b8535b063e17c8fa4924773470b0

SHA512
8daad658207f9e8fd937254c453fb4be8b488cc061ce9e41df83fbd228193da9007feed3bb3ff12188c41a6b733d2851933d276d68d03f8edec3c3de602ca60a

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security

Filesize
56KB

MD5
29b34fe1ee5b9329374ad1ef7587c7d2

SHA1
2fc188499d923a0fdbfa4ad93ac70699d0effaf8

SHA256
cb4819328a486176a862a35ca9ee504acb8e793bcf5ae2011e7bd89633ee6233

SHA512
45f2cfc937861863485b16f663d409890ec8d53f171cb67f356a13c2d34e7a1c8e01114dcbcc28a557a82c4cd51d2c1fcfa0570559236f5705547537a2c498a2

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar

Filesize
7KB

MD5
12f971b6e65cbc7184701235469f0339

SHA1
06cb165157c5e0078b872c48707a1328b1dcba19

SHA256
84e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8

SHA512
58646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de

Download Submit
C:\Users\Admin\ggbKxAcpycv\ID.txt

Filesize
47B

MD5
37dd76a06848c95ff85699c16c972a1b

SHA1
244b93b1c7ca6e62e6f61c147d6096695968f841

SHA256
f16224f507adafae9d8c17c4c7f3c69c44a0d4df45299ca3f95aa75c18e5621b

SHA512
d17e234f2fd4ddd9597aae01695d005d3833eb38c7638e579d17d00365e724a68a6c0e30a822461689c5a3c81746149cf66bfafff757312b9378c9919f95a3c2

Download Submit
memory/400-1189-0x000001C6D3A80000-0x000001C6D3A81000-memory.dmp

Filesize
4KB

Download
memory/400-1207-0x000001C6D3A80000-0x000001C6D3A81000-memory.dmp

Filesize
4KB

Download
memory/400-1180-0x000001C6D3A80000-0x000001C6D3A81000-memory.dmp

Filesize
4KB

Download
memory/400-1169-0x000001C6D3A80000-0x000001C6D3A81000-memory.dmp

Filesize
4KB

Download
memory/404-1412-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/404-1607-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/840-63-0x0000012DDD630000-0x0000012DDD631000-memory.dmp

Filesize
4KB

Download
memory/840-378-0x0000012DDD630000-0x0000012DDD631000-memory.dmp

Filesize
4KB

Download
memory/840-1102-0x0000012DDD630000-0x0000012DDD631000-memory.dmp

Filesize
4KB

Download
memory/840-93-0x0000012DDD630000-0x0000012DDD631000-memory.dmp

Filesize
4KB

Download
memory/1000-1393-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1000-1570-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1072-1012-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1072-1442-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1072-1274-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1248-1122-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1248-1119-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1256-1237-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1256-72-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1256-1238-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1256-64-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1440-766-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1440-764-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1468-1178-0x000001FF56740000-0x000001FF56741000-memory.dmp

Filesize
4KB

Download
memory/1468-1126-0x000001FF56740000-0x000001FF56741000-memory.dmp

Filesize
4KB

Download
memory/1468-1217-0x000001FF56740000-0x000001FF56741000-memory.dmp

Filesize
4KB

Download
memory/1468-1222-0x000001FF56740000-0x000001FF56741000-memory.dmp

Filesize
4KB

Download
memory/1468-1205-0x000001FF56740000-0x000001FF56741000-memory.dmp

Filesize
4KB

Download
memory/1544-12-0x0000000000400000-0x0000000000689000-memory.dmp

Filesize
2.5MB

Download
memory/1544-14-0x0000000000400000-0x00000000006880BC-memory.dmp

Filesize
2.5MB

Download
memory/1544-11-0x0000000000400000-0x0000000000689000-memory.dmp

Filesize
2.5MB

Download
memory/1544-15-0x0000000000400000-0x0000000000689000-memory.dmp

Filesize
2.5MB

Download
memory/1544-31-0x0000000000400000-0x0000000000689000-memory.dmp

Filesize
2.5MB

Download
memory/1544-30-0x0000000000400000-0x00000000006880BC-memory.dmp

Filesize
2.5MB

Download
memory/1612-993-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1612-992-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1636-1229-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1636-1536-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1636-1342-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1664-418-0x000001FC760A0000-0x000001FC760A1000-memory.dmp

Filesize
4KB

Download
memory/1664-91-0x000001FC760A0000-0x000001FC760A1000-memory.dmp

Filesize
4KB

Download
memory/1664-767-0x000001FC760A0000-0x000001FC760A1000-memory.dmp

Filesize
4KB

Download
memory/1788-1212-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/1788-1220-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/2028-1378-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2028-1573-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2028-1256-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2452-1438-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/2452-1028-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/2452-1278-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/3024-1541-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3024-1327-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3024-1226-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3396-1146-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/3396-1140-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/3932-4-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/3932-0-0x0000000000400000-0x000000000094F000-memory.dmp

Filesize
5.3MB

Download
memory/3932-1-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/3932-2-0x0000000000400000-0x000000000094F000-memory.dmp

Filesize
5.3MB

Download
memory/3932-17-0x0000000000400000-0x000000000094F000-memory.dmp

Filesize
5.3MB

Download
memory/3932-9-0x0000000000400000-0x000000000094F000-memory.dmp

Filesize
5.3MB

Download
memory/3932-8-0x0000000000400000-0x000000000094F000-memory.dmp

Filesize
5.3MB

Download
memory/3932-7-0x0000000000400000-0x000000000094F000-memory.dmp

Filesize
5.3MB

Download
memory/4308-1233-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4412-1209-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4412-1210-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4440-1206-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4440-1208-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4452-85-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4452-89-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4752-1281-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/4752-1421-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/4752-1600-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/4904-1059-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/5040-1098-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download