adwind | a9652a92f142b4d3ba8735e9bbf57b3cf6cd323a6381537f9966efd49d048af7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Arrival Notice 00054625367523225.jar
Size 634KB
Sample240828-jmlcrazfmb
SHA256 e2e2f25cbf2bdf82ebd9cb9c7fd157b60537e606b10c85d4955d6460c93d037e
MD5 fa64690dda2484a48fc86411efbb2d43
SHA1 064b7ed248714ad406e408c3d8f3381023e9fa64
SHA512 a2b3bba43a9967609ee016a5ae0c854db2f0d9c02733a83e2b5a7249e66a4c62deb20977f199a669f92a7b9947285e036f685b3c5db82137d35cd9fcff185fdd
SSDEEP 12288:oSCbuX8B8YhKLgB/nWX3MgwqnEMN6ZYjpOwIKI0Ua6Bi4IOtQAITk:ofuXS8wN/WsGPHGa6BioQ7Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind5

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	3540	WScript.exe
47	3540	WScript.exe
77	3540	WScript.exe
94	3540	WScript.exe
118	3540	WScript.exe
144	3540	WScript.exe
161	3540	WScript.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EMLPROXY.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuarScanner.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardUpdate.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CONSCTLX.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKProxy.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserReg.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CONSCTLX.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanosvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavWebClient.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCS-Uninstall.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FCHelper64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiFW.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7SysMon.Exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BgScan.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7PSSrvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiWatchDog.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiProxy.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av_task.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3SP.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\njeeves2.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAService.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Up.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclamwrap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nfservice.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bavhm.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlhh.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANNER.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWin.exe\debugger = "svchost.exe"	regedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nnZsvRADKC.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nnZsvRADKC.vbs	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2508	javaw.exe
4004	java.exe

Loads dropped DLL 25 IoCs

pid	Process
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
2508	javaw.exe
4004	java.exe
4004	java.exe
4004	java.exe
4004	java.exe
4004	java.exe
4004	java.exe
4004	java.exe
2508	javaw.exe
2508	javaw.exe
4004	java.exe
4004	java.exe
4004	java.exe
4004	java.exe
2508	javaw.exe
4004	java.exe
2508	javaw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nnZsvRADKC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\nnZsvRADKC.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nnZsvRADKC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\nnZsvRADKC.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntfsmgr = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ntfsmgr.jar\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCaupIzUvpu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\gcFnZxmziWs\\nxzlEhJBoeg.CWZVyB\""	reg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
932	taskkill.exe
3356	taskkill.exe
4684	taskkill.exe
4360	taskkill.exe
1456	taskkill.exe
4708	taskkill.exe
2540	taskkill.exe
3852	taskkill.exe
1672	taskkill.exe
1016	taskkill.exe
3532	taskkill.exe
3544	taskkill.exe
528	taskkill.exe
4892	taskkill.exe
2816	taskkill.exe
3608	taskkill.exe
3532	taskkill.exe
4492	taskkill.exe
2652	taskkill.exe
2132	taskkill.exe
4776	taskkill.exe
3460	taskkill.exe
2960	taskkill.exe
3948	taskkill.exe
3288	taskkill.exe
4428	taskkill.exe
1844	taskkill.exe
1008	taskkill.exe
3620	taskkill.exe
4508	taskkill.exe
4556	taskkill.exe
216	taskkill.exe
3336	taskkill.exe
3712	taskkill.exe
2144	taskkill.exe
4968	taskkill.exe
4372	taskkill.exe
2192	taskkill.exe
972	taskkill.exe
3532	taskkill.exe
1548	taskkill.exe
4320	taskkill.exe
1324	taskkill.exe
2292	taskkill.exe
1948	taskkill.exe
3508	taskkill.exe
3756	taskkill.exe
628	taskkill.exe
960	taskkill.exe
4436	taskkill.exe
3628	taskkill.exe
2724	taskkill.exe
4200	taskkill.exe
4752	taskkill.exe
2504	taskkill.exe
4416	taskkill.exe
3080	taskkill.exe
4732	taskkill.exe
1664	taskkill.exe
4452	taskkill.exe
1184	taskkill.exe
4268	taskkill.exe
1008	taskkill.exe
2372	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	wscript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
216	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1088	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	1008	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	1184	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeDebugPrivilege	4360	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	3400	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	3712	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4244	javaw.exe
5092	java.exe
2508	javaw.exe
4004	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2836	4952	java.exe	85
PID 4952 wrote to memory of 2836	4952	java.exe	85
PID 2836 wrote to memory of 3540	2836	wscript.exe	87
PID 2836 wrote to memory of 3540	2836	wscript.exe	87
PID 2836 wrote to memory of 3128	2836	wscript.exe	88
PID 2836 wrote to memory of 3128	2836	wscript.exe	88
PID 3128 wrote to memory of 3256	3128	cmd.exe	90
PID 3128 wrote to memory of 3256	3128	cmd.exe	90
PID 2836 wrote to memory of 4244	2836	wscript.exe	92
PID 2836 wrote to memory of 4244	2836	wscript.exe	92
PID 4244 wrote to memory of 5092	4244	javaw.exe	94
PID 4244 wrote to memory of 5092	4244	javaw.exe	94
PID 4244 wrote to memory of 3672	4244	javaw.exe	96
PID 4244 wrote to memory of 3672	4244	javaw.exe	96
PID 3672 wrote to memory of 4676	3672	cmd.exe	98
PID 3672 wrote to memory of 4676	3672	cmd.exe	98
PID 5092 wrote to memory of 724	5092	java.exe	99
PID 5092 wrote to memory of 724	5092	java.exe	99
PID 724 wrote to memory of 844	724	cmd.exe	101
PID 724 wrote to memory of 844	724	cmd.exe	101
PID 4244 wrote to memory of 908	4244	javaw.exe	102
PID 4244 wrote to memory of 908	4244	javaw.exe	102
PID 908 wrote to memory of 1820	908	cmd.exe	104
PID 908 wrote to memory of 1820	908	cmd.exe	104
PID 5092 wrote to memory of 4908	5092	java.exe	105
PID 5092 wrote to memory of 4908	5092	java.exe	105
PID 4908 wrote to memory of 3056	4908	cmd.exe	107
PID 4908 wrote to memory of 3056	4908	cmd.exe	107
PID 4244 wrote to memory of 2156	4244	javaw.exe	108
PID 4244 wrote to memory of 2156	4244	javaw.exe	108
PID 5092 wrote to memory of 796	5092	java.exe	110
PID 5092 wrote to memory of 796	5092	java.exe	110
PID 4244 wrote to memory of 2456	4244	javaw.exe	113
PID 4244 wrote to memory of 2456	4244	javaw.exe	113
PID 4244 wrote to memory of 216	4244	javaw.exe	118
PID 4244 wrote to memory of 216	4244	javaw.exe	118
PID 4244 wrote to memory of 4732	4244	javaw.exe	119
PID 4244 wrote to memory of 4732	4244	javaw.exe	119
PID 4244 wrote to memory of 4880	4244	javaw.exe	120
PID 4244 wrote to memory of 4880	4244	javaw.exe	120
PID 4244 wrote to memory of 2508	4244	javaw.exe	121
PID 4244 wrote to memory of 2508	4244	javaw.exe	121
PID 2508 wrote to memory of 4004	2508	javaw.exe	125
PID 2508 wrote to memory of 4004	2508	javaw.exe	125
PID 2508 wrote to memory of 3340	2508	javaw.exe	127
PID 2508 wrote to memory of 3340	2508	javaw.exe	127
PID 3340 wrote to memory of 4656	3340	cmd.exe	129
PID 3340 wrote to memory of 4656	3340	cmd.exe	129
PID 2508 wrote to memory of 4664	2508	javaw.exe	130
PID 2508 wrote to memory of 4664	2508	javaw.exe	130
PID 4664 wrote to memory of 3636	4664	cmd.exe	132
PID 4664 wrote to memory of 3636	4664	cmd.exe	132
PID 4004 wrote to memory of 4920	4004	java.exe	133
PID 4004 wrote to memory of 4920	4004	java.exe	133
PID 2508 wrote to memory of 2348	2508	javaw.exe	135
PID 2508 wrote to memory of 2348	2508	javaw.exe	135
PID 4920 wrote to memory of 752	4920	cmd.exe	137
PID 4920 wrote to memory of 752	4920	cmd.exe	137
PID 4004 wrote to memory of 3348	4004	java.exe	138
PID 4004 wrote to memory of 3348	4004	java.exe	138
PID 3348 wrote to memory of 2180	3348	cmd.exe	141
PID 3348 wrote to memory of 2180	3348	cmd.exe	141
PID 4004 wrote to memory of 908	4004	java.exe	142
PID 4004 wrote to memory of 908	4004	java.exe	142

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4732	attrib.exe
4880	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Arrival Notice 00054625367523225.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\qehbvgyvvv.vbs
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nnZsvRADKC.vbs"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:3540
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version 2> C:\Users\Admin\AppData\Local\Temp\output.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -version
      4⤵
      PID:3256
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ntfsmgr.jar"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.07218906080447234376676580822006132.class
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5158659608165199049.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:724
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5158659608165199049.vbs
        6⤵
        
        PID:844
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive621892886024617662.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive621892886024617662.vbs
        6⤵
        
        PID:3056
    - - C:\Windows\SYSTEM32\xcopy.exe
        
        xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
        5⤵
        
        PID:796
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7779984703439678161.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7779984703439678161.vbs
        5⤵
        
        PID:4676
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5185963134501776382.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5185963134501776382.vbs
        5⤵
        
        PID:1820
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:2156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:2456
  - - C:\Windows\SYSTEM32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v TCaupIzUvpu /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\gcFnZxmziWs\nxzlEhJBoeg.CWZVyB\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:216
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\gcFnZxmziWs\*.*"
      4⤵
      Views/modifies file attributes
      PID:4732
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\gcFnZxmziWs"
      4⤵
      Views/modifies file attributes
      PID:4880
  - - C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\gcFnZxmziWs\nxzlEhJBoeg.CWZVyB
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.67480362010452475701108975048565745.class
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4004
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7568040077423367099.vbs
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7568040077423367099.vbs
        7⤵
        
        PID:752
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2199625897119958350.vbs
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2199625897119958350.vbs
        7⤵
        
        PID:2180
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        6⤵
        
        PID:908
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5304609122876082027.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3340
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5304609122876082027.vbs
        6⤵
        
        PID:4656
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1065568849137671036.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1065568849137671036.vbs
        6⤵
        
        PID:3636
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2348
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\SfbdtmuhYU9031814465116340717.reg
        5⤵
        
        PID:3268
      - C:\Windows\regedit.exe
        
        regedit.exe /s C:\Users\Admin\AppData\Local\Temp\SfbdtmuhYU9031814465116340717.reg
        6⤵
        UAC bypass
        Event Triggered Execution: Image File Execution Options Injection
        Runs .reg file with regedit
        
        PID:1088
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM UserAccountControlSettings.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ProcessHacker.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM procexp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM procexp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM wireshark.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM tshark.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM text2pcap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM rawshark.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mergecap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM editcap.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM dumpcap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM capinfos.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbam.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbamscheduler.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbamservice.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareService.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareTray.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM WebCompanion.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareDesktop.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Main.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Svc.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Up.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3SP.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Proxy.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Medic.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BgScan.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuard.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuardBhvScanner.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuarScanner.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM LittleHook.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuardUpdate.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM clamscan.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ClamTray.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ClamWin.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cis.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM CisTray.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3288
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cmdagent.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cavwp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM dragon_updater.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MWAGENT.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MWASER.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM CONSCTLX.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM avpmapp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM econceal.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM escanmon.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM escanpro.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3628
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM TRAYSSER.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM TRAYICOS.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM econser.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM VIEWTCP.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSHDLL64.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fsgk32.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fshoster32.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSMA32.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fsorsp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fssm32.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSM32.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM trigger.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FProtTray.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FPWin.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1456
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FPAVServer.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3400
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVK.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GdBgInx64.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKProxy.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4492
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKWCtlx64.exe /T /F
        5⤵
        
        PID:3620
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKService.exe /T /F
        5⤵
        
        PID:3880
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKTray.exe /T /F
        5⤵
        
        PID:1260
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDKBFltExe32.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3080
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDSC.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4708
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM virusutilities.exe /T /F
        5⤵
        
        PID:4760
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM guardxservice.exe /T /F
        5⤵
        
        PID:2080
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM guardxkickoff_x64.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4268
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM iptray.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4428
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM freshclam.exe /T /F
        5⤵
        
        PID:3852
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM freshclamwrap.exe /T /F
        5⤵
        
        PID:4176
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7RTScan.exe /T /F
        5⤵
        
        PID:1980
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7FWSrvc.exe /T /F
        5⤵
        
        PID:1360
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7PSSrvc.exe /T /F
        5⤵
        
        PID:1996
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7EmlPxy.EXE /T /F
        5⤵
        
        PID:1536
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSecurity.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3544
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7AVScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4732
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7CrvSvc.exe /T /F
        5⤵
        
        PID:2912
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7SysMon.Exe /T /F
        5⤵
        
        PID:2844
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1844
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMngr.exe /T /F
        5⤵
        
        PID:2416
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nanosvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1008
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nanoav.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4556
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nnf.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:528
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvcsvc.exe /T /F
        5⤵
        
        PID:3288
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nbrowser.exe /T /F
        5⤵
        
        PID:4668
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nseupdatesvc.exe /T /F
        5⤵
        
        PID:2456
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nfservice.exe /T /F
        5⤵
        
        PID:1116
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nwscmon.exe /T /F
        5⤵
        
        PID:972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM njeeves2.exe /T /F
        5⤵
        
        PID:1536
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvcod.exe /T /F
        5⤵
        
        PID:1796
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvoy.exe /T /F
        5⤵
        
        PID:1928
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM zlhh.exe /T /F
        5⤵
        
        PID:4800
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Zlh.exe /T /F
        5⤵
        
        PID:4452
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nprosec.exe /T /F
        5⤵
        
        PID:4464
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Zanda.exe /T /F
        5⤵
        
        PID:664
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM NS.exe /T /F
        5⤵
        
        PID:1532
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM acs.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2724
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM op_mon.exe /T /F
        5⤵
        
        PID:4924
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSANHost.exe /T /F
        5⤵
        
        PID:1548
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSUAMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4776
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSUAService.exe /T /F
        5⤵
        
        PID:4840
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AgentSvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2144
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BDSSVC.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:4968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM EMLPROXY.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:4892
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM OPSSVC.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:216
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ONLINENT.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:4372
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM QUHLPSVC.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:2652
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SAPISSVC.EXE /T /F
        5⤵
        
        PID:4500
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SCANNER.EXE /T /F
        5⤵
        
        PID:3288
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SCANWSCS.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:2540
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM scproxysrv.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4200
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ScSecSvc.exe /T /F
        5⤵
        
        PID:2008
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SUPERAntiSpyware.exe /T /F
        5⤵
        
        PID:2752
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SASCore64.exe /T /F
        5⤵
        
        PID:1672
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SSUpdate64.exe /T /F
        5⤵
        
        PID:2912
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SUPERDelete.exe /T /F
        5⤵
        
        PID:4968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM SASTask.exe /T /F
        5⤵
        
        PID:4024
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7RTScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3460
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7FWSrvc.exe /T /F
        5⤵
        
        PID:2836
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7PSSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2192
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7EmlPxy.EXE /T /F
        5⤵
        Kills process with taskkill
        
        PID:3852
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSecurity.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2960
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7AVScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3336
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7CrvSvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3508
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7SysMon.Exe /T /F
        5⤵
        
        PID:4196
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4684
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMngr.exe /T /F
        5⤵
        
        PID:2444
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM uiWinMgr.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1672
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM uiWatchDog.exe /T /F
        5⤵
        
        PID:3648
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM uiSeAgnt.exe /T /F
        5⤵
        
        PID:4320
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PtWatchDog.exe /T /F
        5⤵
        
        PID:3496
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PtSvcHost.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3756
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PtSessionAgent.exe /T /F
        5⤵
        
        PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a1867ad60d02d8e068ab75dcbb580251d09515c478f972a3681bc5a09833b753
MD5 c4057349192fd13938af65cb6ffd2631
SHA1 3e8c51bd95086c0a30b0ffdc6a5c49f243042c30
SHA512 cd6fa9632f715eb96795ecd2e5ab0102a941611e922f0080cf4e72518a5181cf120201b8d72e68efca66906e587a3dd8aad8f6cde3578aeca7528a0ed9b5f3a2
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 680620e588bb6b19307236217d3f67bdb84a3f118c83725eeb9894357fbc18a2
MD5 caa16b6a6a74ff27f72dc9fd75a77bf6
SHA1 c4caabdf319c3dc314bb48c26b571d0d2499e902
SHA512 f70a5a44f15b87f6f3ade0d94e74abe813aadd9178ca98bdf27d58ed448a2475a6a2ea81d1c8cc8ae3aa97168a57f3a4942cfc737ca502c18e1b5b3c156761e2
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 806c587d47099cfca65ef69eadc07e172cc24864cb29607798b8e7ec398690c5
MD5 800818ec189696a35149fffdd77cb07f
SHA1 00686dadb1c7e248bf7f547c466daa0a601ca1ab
SHA512 3eb99303113e14f3e86ab39e669cb0233157a8353cb911e7b1385178e427a10696053a704c097fcefe405921742d17f36b2377cf3dc4cf0bcfb8219c92de8f1b
MD5 SHA1 SHA512

Submit Download

50569f7db71fa7f8.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp
Size 54B
SHA256 81dfbd94ee3844f0e4ccbee92b20efe8e963df998be7b795de3aada6657c1e9b
MD5 322077f47531cdcc5c6554f27162037d
SHA1 6a135fa0053b2f3a995ebf61650df07a260a5815
SHA512 294c5ea7c692c044f25534b3f457575007ce28c356903abe1750530d82fc021c0b9f4c37562854586659cf57f1a748f2f5d7d3360307c2c271cf73fd86db42f8
MD5 SHA1 SHA512

Submit Download

Retrive5185963134501776382.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive5185963134501776382.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
MD5 SHA1 SHA512

Submit Download

Retrive7779984703439678161.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive7779984703439678161.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
MD5 SHA1 SHA512

Submit Download

_0.07218906080447234376676580822006132.class

Path C:\Users\Admin\AppData\Local\Temp\_0.07218906080447234376676580822006132.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

output.txt

Path C:\Users\Admin\AppData\Local\Temp\output.txt
Size 147B
SHA256 afdd2e30a49d992e02746954a658ca1d8af5460c2f70607ecdb2b68883cfc421
MD5 878f394e749aeb94775a31acccc09414
SHA1 4255a663fa9b4c141fde96869071d1d29450ced8
SHA512 23637278397943d779cab6b6f3730d5708c8374ac18bed4f4e6b69a63a7e5304d39c5c2c8c48206812d0a2f0cc209620c92c57a39bb489ec9fad63a323f5d12d
MD5 SHA1 SHA512

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_dd06e985-ac7f-4567-b0c7-3752f03c29fc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2412658365-3084825385-3340777666-1000\83aa4cc77f591dfc2374580bbd95f6ba_dd06e985-ac7f-4567-b0c7-3752f03c29fc
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
Size 1.3MB
SHA256 6d1c82cad959b7e4636d8fced4368f0f2c8da4ef609667396e8772ad8d63f736
MD5 39a3de251306cbca47cf2fb10089ae9f
SHA1 cc3f3d1bc3ad172c9646961b18fe1d7bf98b59a5
SHA512 351a02453659d04a2943abc1da2b9541f97982ed3f94d288679dfd8d962bfb4b0dcdef9b06d329bdad64e032b0372733ff7d1577c49952accf86b971aed86f7e
SSDEEP 24576:or19iF8DpwAZGFCFcbtv5nHSaELVPwtDi6MDO6aBN1VWgerlE6:6XiF8tpGFJHwVoY6MDO6aBN1cLf
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Size 162KB
SHA256 179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54
MD5 4e6dfd5867f4cea96dad1d59a0ca43fe
SHA1 6a08abc0b5a2cab00eb6d7543c661aa6620890a1
SHA512 2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b
SSDEEP 3072:dgpGH1/rHpcDJ0oL9JLVZcRysrS7DgWw2xM:Wpg0TZHQh
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
Size 285KB
SHA256 af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e
MD5 dafb5fbb0614c19eccdab9bef8f89c22
SHA1 91ab91eb4a90f02c4950c3e5da80f3eb24bddb52
SHA512 81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93
SSDEEP 3072:5LBM1lpzb9ydKHsz1//3H+ktNNWo7vNnParlMhubG0XqkwnJEszNvarvcLPYDJ67:pWPZw225bN5zFEjGkqkAJHyEzYV/PvyX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Size 285KB
SHA256 a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef
MD5 7fb44c5bca4226d8aab7398e836807a2
SHA1 47128e4f8afabfde5037ed0fcaba8752c528ff52
SHA512 f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab
SSDEEP 6144:PAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:PCd9/WYoaLHF3z0z04PDvhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
Size 104KB
SHA256 833cdbd7b221dda58ba728ee9a41cac1d6819d19bfc7336a4b86cc69a5af3695
MD5 6c720917e5c8ce1202a4141e8c8cfaf7
SHA1 1175d918134983d1d64a42047f4ff814054123de
SHA512 217f824b389547993556c26069d58eb956e87029b5c58556c2d308e48a0db2a02a057b3147fcf6ac7606f2b97ada33e2372112e93944f645137d81cc0dd32a9d
SSDEEP 1536:2vpp3y2kIlAYVZ+qbzKWrTcJuV618k89DmucOiG/OJY9GzNAiKyy0CLLLdx7PPxD:pYSqbzKWrTcJuGbEDmYGeifLCDdxLxD
MD5 SHA1 SHA512 SSDEEP

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
Size 66KB
SHA256 686021b000cd6d76b97c6f924c528293bc55dfb4ce936cfe70959eecd1665c90
MD5 d8a6b5e5a33cb71b61964be369526704
SHA1 7788adf9163fb2ac2c85c43630c0998b0f13360a
SHA512 d15e5832d025a8fb17dd48b8c6d8246b93d54543ba52d40a9f97aff257847f7e05971ae927a77e12ab1625dc514a29115ce5fe9ddad18fe5fc4b0ddc2f8ca6d1
SSDEEP 768:QSwbGTKTjBFs3zdaON+ClYKaFwoqgzizndNXur2Z3/oHbg6wuZWm3w3hUjhgYi5x:olONFYKAQn7Xur20bCCJ3Khyhg75PxQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 8.5MB
SHA256 6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21
MD5 dceeb4fb6af9bb2ea7a2eed1d921afb5
SHA1 af1463a499f7d6eed5efcb9c9515e82335e9c1b6
SHA512 e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763
SSDEEP 98304:OhNdNu6fLpeSRNeOhWnaC5Qu5e9kmhRVfvLP0KsH1OIueGeM1Q:OhNdNu6fLpDRwOhoaCyucC0RVfjPiHuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
Size 142KB
SHA256 86106645d9e3801911808d6343a7fead7b6e9d8b740bad63a4cd9851ff599283
MD5 2632b6d90868ff1ece67f76b86a23d79
SHA1 90ddedde02a4cc37ae361caabc36a6a686c24bd1
SHA512 61e0581c3dde45db74383b93e56396c65435714e746fe4f000c53465e8e6750bd787b5895a987bbdbe4badb5ad3570394c82476c2b4d65099f0b923002153b18
SSDEEP 3072:2zs5pH2Lmngo9QVKTIVbheI14/QwIwS6ycf+lxhC:Cs5pWLmngo9HTMhp14Hpyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Size 55KB
SHA256 9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb
MD5 82bb3a2292372acbf8bb25e30a3e169c
SHA1 c09c134561213cd67c670f60a2c52cf947e51a74
SHA512 db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7
SSDEEP 768:gGq5ZtjA9EC+mzTJaJSMR26WPI/hY5iX2N9mWKYilefjPxWEta:gGsTSP+mG726iI/hqPN9mWK7wjPxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Size 87KB
SHA256 27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9
MD5 0d56a7ff632826362768b3edd5e5174f
SHA1 8b96856f8fe3175039d1a7cf3ac0910467844a08
SHA512 b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595
SSDEEP 1536:d4oESIZDpOoUQ4Ps5OwVOIOQIO6nqejL8j672PxV/:d4o5IZDZUXwV8G6nqejLY6WxV/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
Size 634B
SHA256 80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
MD5 499f2a4e0a25a41c1ff80df2d073e4fd
SHA1 e2469cbe07e92d817637be4e889ebb74c3c46253
SHA512 7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
MD5 SHA1 SHA512

Submit Download

charsets.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar
Size 2.9MB
SHA256 04a6bc7af4d41fda5ca6c7584df50c5d0881fada89b4788e8ee4e5919345f143
MD5 bfdb22624544f02100cd37cff954f64c
SHA1 f699b290845f487cb7050d41a83b85446ea202b1
SHA512 70c5f501c5e1cc67341bb3f4d190179a79fb8bee7292ff8cca0749368ae4475387ce121e8d33adc7e4e6fad5a10eab378fff17e3da0422d4cca0837c95574b95
SSDEEP 49152:WmiR2z1nkI+mstfIrIUj0z8zRnvvyllbIWLrm:WmiMzNwxN+5n32lbI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages_zh_TW.properties

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Size 3KB
SHA256 ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
MD5 880baacb176553deab39edbe4b74380d
SHA1 37a57aad121c14c25e149206179728fa62203bf0
SHA512 3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
MD5 SHA1 SHA512

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index
Size 1KB
SHA256 f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8
MD5 005faac2118450bfcd46ae414da5f0e5
SHA1 9f5c887e0505e1bb06bd1fc7975a3219709d061d
SHA512 8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9
MD5 SHA1 SHA512

Submit Download

sunec.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar
Size 46KB
SHA256 cfe84c5292f9ddef96fecf118377565bbaf769eee7ff4cca81652fe1134f9809
MD5 1227482c65dc231e3607b002950f5497
SHA1 709ff3738d5da8db225818df2966f04c13cb7d02
SHA512 87c4f5fa1e6dad6f2fab8a0371380fa7be9f63b05f8ff6740a4208ec115f8db9c512de9e40b4b853be35effed2804d0774c0e9426571a129cb6bdecd527cdb8c
SSDEEP 768:4731B13B5aguVlb2TUVMbLjwP7l6lxiHsWhoc2toqMmrV3lkwhEafSkjmPX+M6ij:2/7ggIYU6GlQ0Hnhoc2mvA3ewSafSZPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunjce_provider.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
Size 287KB
SHA256 324499cedd3f19ea621a38f42834369d7da8bdf40fcb5a345007bfa2e5987780
MD5 456031723ebc7270d9bc3747cdd6daa2
SHA1 a4a61bb10ac83f201854a11750aa86e7dc8da41b
SHA512 b425eabd590f905aa147720aa507a0da2b31199956f21137a722fe6c8de05549d1cddbb2fb2ea1cbe34e39ce9d0eabb0502dd2a9a09f72dd87cd002765537079
SSDEEP 6144:5lQ8GTsacebwePne9NuAZ9ObVT/slrNoCawdxpFfGi8+jBuTW:5bAPce0l9NuAZwlsl1dP86B0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

win32_CopyNoDrop32x32.gif

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
MD5 SHA1 SHA512

Submit Download

jce.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
Size 119KB
SHA256 4362c179bb78107777d6a0557693e65eb2b318c26642162f89509dfdab8c97fe
MD5 e0b7e0f36b9fc43d13403145db82e758
SHA1 def42078cfa315e98393c69963efb4e35e2e28a8
SHA512 5074a7ceb9621096f3bbf419d32ac260ea6d9d09c758544c2761121026c2b9db0b6617806d3b692347b685d541123f4eda99dcbaa29d9c9a2d740b22c44bf7bb
SSDEEP 3072:p+uhK+XLGLuDfH3HiMAHElMueD+UgUBvVE:/f6Y3HiLvJ+Uju
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar
Size 560KB
SHA256 bded3bbadd255c856ed7fb9900cbf0445e980a669a3aa043cf095e18539eb48f
MD5 530b1ee313390d5d51ae8f5aa0be9070
SHA1 d5de5ee8bd7275b5b20f466ba0869251679b24b3
SHA512 50671ca7de240c38921849304ae482a52ae481d0ff5a2f02aef90c20b9f49842bf2ea32b9caabde57a955b8d638a017b6b3cdd662b679a2d743e029f97b88937
SSDEEP 12288:D5l+qU67FYWg+YWgYWeoXqgYSqYQh2f/m5NwaHkSIJHvWQ6Q7ooMcgH5lY7TQ5cG:D5l+qU67FYWg+YWgYWeoXqgYSqYQh2fC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
Size 1.7MB
SHA256 fffafe7e2bacef79280a4565b5d1075320a8ec38dff7978c8fe6c033b6df49d0
MD5 01408480f5c65da8c74ecfde0eed1a72
SHA1 2f1cb5df6d4879de8b0827d160e9bb281f829a3a
SHA512 ae585f4825073da19f611bb7d11a1d075b4998bc3f7d53a67cdba778e0729e0b5134ce8fc49897f67d39e46f1209524ab53ab4551defc6a4127012e332f15d61
SSDEEP 12288:HjlqLkoqdD4YH+b8RseFxOs/Mf8AMBIbvTHegwbC3:HjlnPHq8R7FX/SoBs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
Size 2KB
SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
MD5 91aa6ea7320140f30379f758d626e59d
SHA1 3be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA512 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb
MD5 SHA1 SHA512

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
Size 3.4MB
SHA256 65a6d0d74b193af857dd5252d59e8bf9214ddb360b26c1da816b029bf0cf208c
MD5 c5152884c2676dd45109cfeba088a549
SHA1 8fe4fd1980bdc4139491b0dd963eb830b70bb8d6
SHA512 ed8d4777609024960a7037f42937de41c434df4ff7062b43f03f0060e326bdef7917e941c9d3db5a8ec7a65f4890ef3dd53c87401f9568e6f068f2930d558e61
SSDEEP 49152:V8qj1I+WQRuLxNJYtFAAkSRKPVujsdWiqUh7yloDqq59wfkOrwBnaN9R3+HgGK2w:zKlYL
MD5 SHA1 SHA512 SSDEEP

Submit Download

blacklisted.certs

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
MD5 SHA1 SHA512

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security
Size 55KB
SHA256 b5e8205764b83f46b50187b2021de7c86a890df908a8d6c17275a68924f832c6
MD5 8f0e3440fffdbcaa9d26be4730492a66
SHA1 20a3e5a8ecbec20d41d7124120d264f61de96613
SHA512 c04528769ce780e730ef71803ca8191c217f571f62703daca273499b90e93101383a3699263458c205cd7a8733399c3c2ca6afc85b6843c2c5e2ba0890e762cb
SSDEEP 768:rn4LHAEcqrlANbX7qL1AdL3naP2rOpOQSvbOETyqp+Z+Ijt+M38ykbLIsS8e677c:rs2aVOQCbOETyqpmLjt1CLze0YKQN3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Size 3KB
SHA256 761aab2969883e9e5ea76df63ca404fb67673efc3f97def057f8e22517fc9518
MD5 6cbca5808b4a8613d2fed6fe4a84c449
SHA1 0135b30ebec03fb69d79cdc3126e608d9effb8b2
SHA512 4d9bf052aa124d07673c601cbfb83223b87369f7be7575a13e13c0d893e57849ba11e430b7769901782c26471528dfaa130996916451e1a7e38cf28468e44cfa
MD5 SHA1 SHA512

Submit Download

local_policy.jar

Path C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar
Size 3KB
SHA256 02f69a433405ea928c89a8aade74e5462282ccb9a9d30851312ed3459398f85c
MD5 360663f26c5584e6c6127254b261fa0c
SHA1 aee6515eede2ad7c697ba8a61bdd9359be3319d2
SHA512 e3920d5abbbe6b0e3029ed1e0b2ce1a53da6c7e728f635b12f00b1fd2eb6151fff74b9dc85ec0c0920f7fda440c1604d24ca766cdbcb78be3425088d97e00208
MD5 SHA1 SHA512

Submit Download

nnZsvRADKC.vbs

Path C:\Users\Admin\AppData\Roaming\nnZsvRADKC.vbs
Size 19KB
SHA256 3872d974eb62e126ef4a997e017f4ad32a92d861409da837405ca524eab20902
MD5 e3ff4fe29503b0e473341a488508fe15
SHA1 eb4bd5236b9e2c71260490dfe7abe995b7a86233
SHA512 4d415dc414d6fb72620872642ca2aa6d5fe42947d655edfd45b309cee4e19eba0f7adc13f6c59e285087f3904ef1972e186926f714ca8c90d457b7617f3eebed
SSDEEP 384:Iq1zWWA6+us+XZe8CTkzLZgz8EF4Ihj73EMVjU8knswyeAmex:IqhTekzlXVW33phw9U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntfsmgr.jar

Path C:\Users\Admin\AppData\Roaming\ntfsmgr.jar
Size 478KB
SHA256 07e13a645058b0f0afe4e79a34abf08dbead97c50b41cb9593035af13250e0f1
MD5 b93df40c82b94680218ea964b5ce6808
SHA1 962dc80127729cfce00906f1e566ce268243ed69
SHA512 06103719d238ee3895c7dec4dece796c10ad9d27703bc2f3d2e8ef55abc426803b76283cc1eb4a5e74d9e0b9e290e5c9132f3cead678f32b334f4032617ebb7f
SSDEEP 12288:JSbImTqq45WeN9VhR5q8jMYw5pxogQNUhIK/0c2qnAI:UbTqq45WYXhRfM3sS7B2qnf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ID.txt

Path C:\Users\Admin\gcFnZxmziWs\ID.txt
Size 47B
SHA256 633036d3de4a8feca1aa6db7c2e558fa6df8c7e1a882b3bbd78a20c3d72f9750
MD5 49b363d8bbf383cb17e692536b0a3d59
SHA1 407772b3522437b5b400b64c2e57983ff8abd187
SHA512 71f6245bb080be7c63ba3bc9bc4fa77122726636f69f91beda9f4b1f5e5cb6bd77f63a4c03f88da2ff29494112dd4e57338fafa0f94955c6c0c2cdcb50d95fd9
MD5 SHA1 SHA512

Submit Download

qehbvgyvvv.vbs

Path C:\Users\Admin\qehbvgyvvv.vbs
Size 926KB
SHA256 efe0596733199a68ae53231c47fc62845f3270c3ecafd0636b450c49220b7302
MD5 e4a33a539193ac920e786f5bc95aa575
SHA1 2ebfcbf95523edb396cb6c5247db0bbd9dfe46e6
SHA512 0ed289b3f0b43a6bbbe9f9da0022cd2cfc11719fa50d0902ac5bb181acc5d9726a47eaf683778f95889a597d68b291ce4d3a799f8cded36de3faccc3f6fcfd73
SSDEEP 12288:NvQoKrP1l1pHQeceRcSSrwBV8OmrDlntBVeQu/IUoXXSdfnk3QxvjzliXxka0yXw:MrPL1pwnwpSC81fBVpu/uXSnOua04w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2508-1133-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/2508-1123-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/2508-1117-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/2508-1071-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/2508-1155-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/2508-1153-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/2508-1145-0x000001E70A2D0000-0x000001E70A2D1000-memory.dmp

Download

memory/3256-34-0x0000024228B00000-0x0000024228B01000-memory.dmp

Download

memory/4004-1162-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4004-1175-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4004-1176-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4004-1124-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4004-1097-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4004-1152-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4004-1122-0x0000017211EE0000-0x0000017211EE1000-memory.dmp

Download

memory/4244-94-0x0000027142570000-0x0000027142571000-memory.dmp

Download

memory/4244-78-0x0000027142570000-0x0000027142571000-memory.dmp

Download

memory/4244-1018-0x0000027142570000-0x0000027142571000-memory.dmp

Download

memory/4244-553-0x0000027142570000-0x0000027142571000-memory.dmp

Download

memory/4952-13-0x000001DD13680000-0x000001DD13681000-memory.dmp

Download

memory/4952-15-0x000001DD150C0000-0x000001DD15330000-memory.dmp

Download

memory/4952-2-0x000001DD150C0000-0x000001DD15330000-memory.dmp

Download

memory/5092-92-0x0000024D17410000-0x0000024D17411000-memory.dmp

Download

memory/5092-109-0x0000024D17410000-0x0000024D17411000-memory.dmp

Download

memory/5092-704-0x0000024D17410000-0x0000024D17411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads