270e5f2f52319fd8d8166cd1297c3c0e78314d718aa492e98d4940b444f77e67

Analysis

user interaction
yes
max time kernel
429s
max time network
451s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jdk-26_windows-x64_bin.exe
Size 188.7MB
Sample260416-rt6w2aa18n
SHA256 270e5f2f52319fd8d8166cd1297c3c0e78314d718aa492e98d4940b444f77e67
MD5 15f67210ec65d2916e3158258315e9ce
SHA1 11818e64e793352c12a03604798aaa0a3c98add8
SHA512 9e295f7226726c5179ece0fde1b48daa196b8dbaef814e2073422677965add269534733a1c6659c03dcb65b7f61c7ac6377717cfe8c06ec1fc2676eafdf4b289
SSDEEP 3145728:fYn85aZwcaGSjgCY/Gb3K4H7dqbkgatzY0Z4igHlKdHsXJ+AbX8uYvuHa/9xtFOA:/gZw9GSkCdbahatPGQdeJfbX8uYv/9DF
TLSH
T14698331DB6384179F07BD278CD9B0936DAB1B8968270869F13858DA82F67360CF3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
40	3468	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	MsiExec.exe
File opened for modification	C:\Windows\system32\WindowsAccessBridge-64.dll	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-26\jmods\jdk.editpad.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\jdk.jfr.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.base\unicode.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.desktop\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.security.jgss\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\server\classes_nocoops_coh.jsa	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.desktop\harfbuzz.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.xml\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.xml.crypto\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jdeps\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jfr\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\api-ms-win-core-processthreads-l1-1-1.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jaccessinspector.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\ktab.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\conf\security\policy\limited\default_local.policy	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.internal.le\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\api-ms-win-core-debug-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\conf\security\policy\unlimited\default_US_export.policy	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\java.xml.crypto.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\jdk.jshell.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.scripting\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.crypto.cryptoki\pkcs11wrapper.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jcmd\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jdeps\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jdb.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\management.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\jdk.jstatd.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.javadoc\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jpackage\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.localedata\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.security.auth\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.unsupported\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jmap.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jwebserver.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\conf\net.properties	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\include\win32\jni_md.h	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\jdk.jartool.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.xml\xalan.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.internal.md\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\api-ms-win-crt-locale-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\api-ms-win-crt-multibyte-l1-1-0.dll	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk-26\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\include\win32\jawt_md.h	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.xml\xmlspec.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.internal.le\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jstatd\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\lib\ct.sym	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\javajpeg.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jcmd.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jstack.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\conf\management\jmxremote.access	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\conf\security\policy\limited\default_US_export.policy	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\java.desktop.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\jdk.hotspot.agent.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\jmods\jdk.naming.dns.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\j2pkcs11.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\jawt.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.attach\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.httpserver\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\jdk.jcmd\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\lib\classlist	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\api-ms-win-core-processthreads-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\bin\serialver.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-26\legal\java.base\zlib.md	MsiExec.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI2DFD.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1218.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1362.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI155B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1697.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E50.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AADA29CC-38A2-59F2-85F5-CD5335AABBE0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1303.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI150C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1638.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E81.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E82.tmp	msiexec.exe
File created	C:\Windows\Installer\e5902b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5902b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E1E.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3132.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1420.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI149E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5902b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1700	jdk-26_windows-x64_bin.exe

Loads dropped DLL 32 IoCs

pid	Process
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe
2928	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e84a8a56950f5a230000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e84a8a560000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e84a8a56000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae84a8a56000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de84a8a56000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Console	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\System	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC92ADAA2A832F95585FDC3553AABB0E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\ProductName = "Java(TM) SE Development Kit 26 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\javaw.exe\IsHostApp	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\java.exe	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command\ = "\"C:\\Program Files\\Java\\jdk-26\\bin\\javaw.exe\" -jar \"%1\" %*"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "jarfile"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\PackageCode = "CE2F0C5F0D8E92D4795C80A8D6D1A484"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4F4A3A46297B6D117AA8000B0D022006\CC92ADAA2A832F95585FDC3553AABB0E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\PackageName = "jdk2664.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC92ADAA2A832F95585FDC3553AABB0E\ToolsFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\LocalLow\\Oracle\\Java\\jdk26_x64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jar	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\ProductIcon = "C:\\Program Files\\Java\\jdk-26\\\\bin\\java.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\Media\2 = "DISK1;1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4F4A3A46297B6D117AA8000B0D022006	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\java.exe\IsHostApp	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\Version = "436207616"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC92ADAA2A832F95585FDC3553AABB0E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\LocalLow\\Oracle\\Java\\jdk26_x64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\javaw.exe	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
212	msiexec.exe
212	msiexec.exe
540	chrome.exe
540	chrome.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3468	msiexec.exe
Token: SeSecurityPrivilege	212	msiexec.exe
Token: SeCreateTokenPrivilege	3468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3468	msiexec.exe
Token: SeLockMemoryPrivilege	3468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3468	msiexec.exe
Token: SeMachineAccountPrivilege	3468	msiexec.exe
Token: SeTcbPrivilege	3468	msiexec.exe
Token: SeSecurityPrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeLoadDriverPrivilege	3468	msiexec.exe
Token: SeSystemProfilePrivilege	3468	msiexec.exe
Token: SeSystemtimePrivilege	3468	msiexec.exe
Token: SeProfSingleProcessPrivilege	3468	msiexec.exe
Token: SeIncBasePriorityPrivilege	3468	msiexec.exe
Token: SeCreatePagefilePrivilege	3468	msiexec.exe
Token: SeCreatePermanentPrivilege	3468	msiexec.exe
Token: SeBackupPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeShutdownPrivilege	3468	msiexec.exe
Token: SeDebugPrivilege	3468	msiexec.exe
Token: SeAuditPrivilege	3468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3468	msiexec.exe
Token: SeChangeNotifyPrivilege	3468	msiexec.exe
Token: SeRemoteShutdownPrivilege	3468	msiexec.exe
Token: SeUndockPrivilege	3468	msiexec.exe
Token: SeSyncAgentPrivilege	3468	msiexec.exe
Token: SeEnableDelegationPrivilege	3468	msiexec.exe
Token: SeManageVolumePrivilege	3468	msiexec.exe
Token: SeImpersonatePrivilege	3468	msiexec.exe
Token: SeCreateGlobalPrivilege	3468	msiexec.exe
Token: SeCreateTokenPrivilege	3468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3468	msiexec.exe
Token: SeLockMemoryPrivilege	3468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3468	msiexec.exe
Token: SeMachineAccountPrivilege	3468	msiexec.exe
Token: SeTcbPrivilege	3468	msiexec.exe
Token: SeSecurityPrivilege	3468	msiexec.exe
Token: SeTakeOwnershipPrivilege	3468	msiexec.exe
Token: SeLoadDriverPrivilege	3468	msiexec.exe
Token: SeSystemProfilePrivilege	3468	msiexec.exe
Token: SeSystemtimePrivilege	3468	msiexec.exe
Token: SeProfSingleProcessPrivilege	3468	msiexec.exe
Token: SeIncBasePriorityPrivilege	3468	msiexec.exe
Token: SeCreatePagefilePrivilege	3468	msiexec.exe
Token: SeCreatePermanentPrivilege	3468	msiexec.exe
Token: SeBackupPrivilege	3468	msiexec.exe
Token: SeRestorePrivilege	3468	msiexec.exe
Token: SeShutdownPrivilege	3468	msiexec.exe
Token: SeDebugPrivilege	3468	msiexec.exe
Token: SeAuditPrivilege	3468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3468	msiexec.exe
Token: SeChangeNotifyPrivilege	3468	msiexec.exe
Token: SeRemoteShutdownPrivilege	3468	msiexec.exe
Token: SeUndockPrivilege	3468	msiexec.exe
Token: SeSyncAgentPrivilege	3468	msiexec.exe
Token: SeEnableDelegationPrivilege	3468	msiexec.exe
Token: SeManageVolumePrivilege	3468	msiexec.exe
Token: SeImpersonatePrivilege	3468	msiexec.exe
Token: SeCreateGlobalPrivilege	3468	msiexec.exe
Token: SeCreateTokenPrivilege	3468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3468	msiexec.exe
Token: SeLockMemoryPrivilege	3468	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3468	msiexec.exe
3468	msiexec.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe
3976	taskmgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1700	1368	jdk-26_windows-x64_bin.exe	96
PID 1700 wrote to memory of 3468	1700	jdk-26_windows-x64_bin.exe	99
PID 212 wrote to memory of 444	212	msiexec.exe	107
PID 212 wrote to memory of 4824	212	msiexec.exe	131
PID 212 wrote to memory of 3084	212	msiexec.exe	133
PID 212 wrote to memory of 2928	212	msiexec.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4476,i,16982472260761236395,8712411715800976248,2097152 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4488 /prefetch:2
1⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\jdk-26_windows-x64_bin.exe
"C:\Users\Admin\AppData\Local\Temp\jdk-26_windows-x64_bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\jds240668156.tmp\jdk-26_windows-x64_bin.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240668156.tmp\jdk-26_windows-x64_bin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk26_x64\jdk2664.msi" WRAPPER=1
    3⤵
    - Badlisted process makes network request
    - Enumerates connected drives
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --metrics-shmem-handle=4680,i,16096639247882739637,4206668125657867913,2097152 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4712 /prefetch:1
1⤵
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,13622293408046739131,17842483375758265318,524288 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5672 /prefetch:8
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5744

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2E61D5B2C85D11B473344472F5602ECB C
  2⤵
  - Loads dropped DLL
  PID:444
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4824
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 617DCE205FE0CD785E5BAEA7C53616BA
  2⤵
  - Loads dropped DLL
  PID:3084
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F38A85A11B7FE6D16F6D006A7470AACF E Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,10243010666178654800,14149853055709033598,524288 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5932 /prefetch:8
1⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,17644415114900491850,15255036088949365989,524288 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5688 /prefetch:8
1⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,15857341680091086326,14306099712340448341,524288 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6092 /prefetch:8
1⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6248,i,7760214766977823632,14183161694812700681,262144 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6244 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,8880525766272633474,1941056521542717066,524288 --field-trial-handle=2052,i,10030858040869747924,1864795009827060392,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6096 /prefetch:8
1⤵
PID:5304

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5902b6.rbs

Path C:\Config.Msi\e5902b6.rbs
Size 10KB
SHA256 01eda7e45773368fe9a4c8bca5cb21a5d4e1e1c40c0e5f1d915d67894818c850
MD5 18b37de1a2b4d51b7505bb1da39bde97
SHA1 09206828265f1c7eb2399316e15e8e9104ee0ede
SHA512 5647f7aceeb6a4dc111245daaa1686c140499daa6324d4628970955e94b3ae533ec62d56ac168b97f0ed1820b96e86711e044adae385ebb08480fe0fd62c4125
SSDEEP 192:LtT8eUBcLn4/whxiGfeAeXAu8lIH8lEvByf5xn4q4DLaer74nqpzxt8sw0o0W3Zr:LueUBo4/wQp8u8a0r
TLSH
T10A226192FA00C5E2F8A61B34C70727583BE7D2CCDB25678B05CC9264AF8A74D0F9518B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\Java\jdk-26\LICENSE
Size 6KB
SHA256 4d156eecbf6ca462d8cf772552fff874b167f87def9566837fb8e4fb347f29a5
MD5 7369866495acb2d7e57397f06a3ab0ba
SHA1 e75e828ba2898c74b4a682ce5291a69acf9cc55a
SHA512 6c1ae5229953259a258bf140241afa9dc50b642dbb5a11c183c8920678292266aecc26dd1254c3ce9184fe08c3068e2183a694a9a06f5972cc535015461ff825
SSDEEP 96:zv146Rru8qRzzhHr9CyY2iOcOXcn8vPkeE0Uulp7BZV0HS/9zq:7S80r83Fn2sX0Bp7X2HQq
TLSH
T133D1306A6E0613E20AC382E63B079E8EF21DC439773951B23469C11E6267E3D41FF5D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsaccessbridge-64.dll

Path C:\Program Files\Java\jdk-26\bin\windowsaccessbridge-64.dll
Size 70KB
SHA256 4b7f52f98156b5d80e7c0faff75a11c1d1a6b6443cd72288f41e8f5a681edf25
MD5 beb26c615fff7beff36c77025dc53e47
SHA1 551d573e69bcfeaada9ab9bca4607a549a987f95
SHA512 bbb44d89f1c78d5754e5ec6c1f03e80cb462ae07906d1ae214ac894977f8ab67a3f9e2588595301c6f16c831c9f6887c92f086bea65c12bd2e38b81d3c45c946
SSDEEP 1536:lwR421YU4W+w4r4ze9fcta8TFG2CC5M71VW:Sm2aU692F/CCqZVW
TLSH
T167632C13F29420F6D22E817D88F18115AEF97BB80633474BDB7FA11B8B92152563E736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files\Java\jdk-26\legal\java.logging\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\Java\jdk-26\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

Reference Documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Size 96B
SHA256 bc5beb7c82f2a4ac67adc4821e52addeb95f28f6929945477eaefd2378a02912
MD5 57b3fd2ca9bc067c65484e915d019e1b
SHA1 61f183ab0926830c3252fe833ab048b6c4381fe2
SHA512 c13a8d2784a88bd2653b96661473ada033ace1cf6f858cac798bf6f5aa9ace4bf6f0e1b1b5f9e286eadf6ff6a8784a3b9abe55641eb9798c1c91b03cbf15fa69
TLSH
T1BDB0126C8505C168D28141034070FC049C0DB5910CC3D88C63C0DECB0E84081C809A27
MD5 SHA1 SHA512 TLSH

Submit Download

Reference Documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Size 145B
SHA256 d8f8cf8690f26e512e5f21aa871a4bbb44069a55841364a5377c04662424619e
MD5 4057c0654e524eef066c2a53cfbab7d8
SHA1 d326ebd4b5ccdac3ac291999df254892173ba9d0
SHA512 e75c633dd9f4a1fd9b7b2c921d8e73ccbe478b0bc8dad02c555466318ea026cb5e08eff48608850cd9e44143d254424a1307d11e5e698d4e97ad19645bee0948
TLSH
T132C08C6C89049155C1425C0650B0FC08A80D7AA00CCBC88C92C0DD8F0E88091940A626
MD5 SHA1 SHA512 TLSH

Submit Download

Get Help.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
Size 175B
SHA256 7f75a65299b7abfad831523c53a38ca4454d63972b7b33390f0e73a070ae73b9
MD5 0b7f7b921d15c8f4651075739aa1c64c
SHA1 a2faad6346abc164c037e168f247ade8b3a50c82
SHA512 01c96b880b77581c9e149e29e8826a3f04a15c0ab5f5bc004988acaa267eef12e584ff7ac3c9294382093d029cc0cfa185596d8467906d80e9d1d4dda290c9ff
TLSH
T1DEC0806CCD08C1E4E15355861B71BC74E50D74E019DFC84DD3C2CE8F1D445418C09E72
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 4be903a0fb9c24009984c811d76ba25f34ba65dd6b3593ace2bfd30e2106ea91
MD5 c1122705975c1eccd5f910ed3cf91e2e
SHA1 aa1837721fc914eb3eb9a89ce500f4f887e3742f
SHA512 822e434416fd15201f909f8efd3ebd7d26e0a77beedf1b5ea4f664cf0936e231029b329b9e721da6c6a377120ffa883ff7e062065e923c0324dad8f447ab8c6a
TLSH
T135F0DCBB69796AB34C36841C2FF4DBB034B1974E1581052E2C3B05C54AEB383F07E429
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 727B
SHA256 1390c558e8e7cfceb1c96abd75d3d0a3be213f43b4057a3058b6ec9c81532cda
MD5 1bab3dbc845ad9ec3aa7536979de308a
SHA1 bef26eaad48e1c7fa08a19ada634c945a8b53f21
SHA512 9234fcb3153d738bcd51b752a5a1cb1ea45a8e6a56b16a5c0b1a4859a857b7416294db2d39dc667dc972c453cf8d55b1fb2cf4b6e14d1b949c430e6a9c542ef7
TLSH
T102019419BE2640A551228FA44F44213DFAE56531AD8DF62BBC7BC081105E32ADB1BB72
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 d438abb946c354f9bcd3dfb5df7689bf730a40efd7c70cc71f82c598242887aa
MD5 57e58dd60bea54ceef6ae2d324a3c8f8
SHA1 59560fb7cfeb35bc38d2d1ed6e7353def92e3d29
SHA512 422fbba082a7963394f46bf27ba12d4c6acb5bf6b63efb234351096d80464f9bfea924e114fb71f541d0e7fe68124c8bd0e2090cedcf3bfaa56a5e2a1dbbc465
TLSH
T1D6011547B838562175265C12D7AC56F5F17BC5452089839974F0264704AF3F9DE1B099
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 e668e5f96192d52666ec05f5b4ee3471c3eb0a6b6721d183a4bec5ddc9250e95
MD5 a34783433d4e4b20cb161ecd93534dec
SHA1 ec4bfe6f8d5f9b2e714bdf5f8eec324fa47c6a19
SHA512 f8fd75d759acfbbc556cbe057275a7a5ac3d5f6966432a2c84442cdc2b38dffa820a06c636a72fe883b808673919efd744f69134e4b33b93d10506b8b8431b75
TLSH
T1E2E0C02017FB511EF160873402E691D59F25F0032C51A2BE0481147DB802A105C63C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 408B
SHA256 ab3bda24a905afc72f2e140b57f351fac1d1ee854db2752a9810c39db60263e7
MD5 a3675384c96d69c213b391fbd02384be
SHA1 b482c5dbefcc27fe0769cc8f93d939e5055c91d4
SHA512 1518cd1fd78b4ff973c5659bfdd4093402cf63fd4bb2337e4dbd7b88a2317ad6d07b4db41c514943f4e9eeafe30ec387f9f3c8fc8620876f139a0f32abe03422
TLSH
T14FE0C03431F6504DF0B1E43543E5FA21CA5AF2021905927D00800254BB20B402DB2524
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0c92518fb8ae3234dabc51096a93c251dc8ea0e1ad1c90934bfa4ae3163f016e
MD5 10626ec442d2861758465e2c02a43f33
SHA1 76279799c3a299fba5121c9a44cd29c3f380f88e
SHA512 0418e046a0aaf7aa7b93c3bf1749be3e580510e4d74ec50fb0ae1069240865c83ec15419d2d1813951481a418aab83f933f16345952794349395901951f254b8
TLSH
T1D7E0C02812FBF00EF450ED3145FAF1711E48F3022140A37811C04318B707F006D159F0
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6C90.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6C90.tmp
Size 935KB
SHA256 09f5430e8bbb69faceecb2cb55d899699a1d176e24d6344e8aa12bf029796aff
MD5 7438278b5db4ec80e3d79b0039495026
SHA1 02e96e21e07d44829e64d2ce23d0862b122fa580
SHA512 7bcb518a3fe390935ab495f884560c25b2ee1df254903a59fe0055af3fb55567643b788ba14e09c13fa96cdb46c5d721c8340726a7dd8578e50aa8ecd4a95ea2
SSDEEP 12288:no7G1FRWI3USD5r9FvzlIp1fY7sx1XD3BR4gN/24AQh:oqXlxDZ9FrKp9Y4x1T3rNDAQ
TLSH
T105157C0AE7A8027DE0F7D278CD978916EBB6B84A4271964F03D146963F13760DE3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9F8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9F8B.tmp
Size 962KB
SHA256 d5c60226a44db883e69240e03ff86588199b52a3c11b81ac7ba2636ce33d9782
MD5 9cbae637b7d73482bd41e417c8def2cc
SHA1 cf67774ae4f12da8966b04c06b5410e222a374c2
SHA512 a11b24a8a355e30d22f0d4a9c2d23c086aaebb55d3efa7c816e3908b2ccf4188459605557ed0573818c939dac64a8fb5cf0ad72add60e6479682f5c082e435ba
SSDEEP 24576:FwLIySfpNXWG/62y/+rQy4mcl2QKdF1fPXg6IR:Fw0FpNXWGS2y/JmB1f8
TLSH
T1EF258D0AA7B8027CE0F7D2B8CD578903EB76B84A42B19A5F03D056962F53760DE7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 167KB
SHA256 ce12f26a719b58dd8a128405428e37d32a05a7bc00d133282527d9e16172c41a
MD5 b68164e1f10fc5a60c9b2ffb2539dad2
SHA1 5bd7a19dff56299f6d3267d7169abbc1851e6697
SHA512 a046842b51e89adc49ce85643270fdf20b22a0c6e7f38d3956b0b6353afd1d899861330b98774b0ab5f800aa41afd3f7a82bcab4e5ce9439f5c41595120a6c5c
SSDEEP 3072:UgVNODd7FqOKYG7lrX5QphRTw7t++YcaV02KmrZtOLMQj:bAHOHj
TLSH
T139F34456C93E84FB64234BD3C7BA7D6456632A0B63DE491832CF86DE6441803C56E8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 185KB
SHA256 82ae78a58d2ccf574e4af2c27d001efd3aa61ec20196cf7538fd98237e53e551
MD5 b021d38ca51b6de89f59654d2d03fa61
SHA1 d2a9a4faf42d107969949356b8dc79353528974c
SHA512 4cbc1db57343bd24fd2ec9f7dc506f365476e4f486a405fe913c975d9590c4c54932bd3bc63cfc7d0105c9f3d3983a47ba4986a576adbedcbf9e49a0a2f84a31
SSDEEP 3072:UgVNODd7FqOKYG7lrX5QphRTw7t++YcaV02KmrZtOLMQD:bAHOHD
TLSH
T13F043656C93E84FF30235AD3C3BA7D6456622A0B53DE891832CF96DE6441903C56E8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 194KB
SHA256 93ae5e62befae60975110d93185db21a33a9ba9eed1c060229f5e70ca9b47648
MD5 fc6a15252ce281b4395b5c8e7dcb20ee
SHA1 31abf5c60b96ed7f5a0d9e2efa7aa08756913a86
SHA512 98d4b9aa16dd250b24022cc148ff8b2d4c2b7ce925110d9027e7620ae9b577bf66650c267ae3790c614964fa2d7faa2ee22d46e76544e59ba57e4860f3465767
SSDEEP 3072:UgVNODd7FqOKYG7lrX5QphRTw7t++YcaV02KmrZtOLMQH:bAHOHH
TLSH
T140143596C93E84FB30235AD3C7AF7D6455622A0B53DE891832CF86DE6441903C56E8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 198KB
SHA256 3766c1e9037135a1003900112e801c28e3c9bb5168fe2d5ec19e677b5ab3b051
MD5 6013f0e5dce8a04ebad1bb194bbba0d5
SHA1 f24b0233e63cf4540c82273b5413ad42e3df8a9a
SHA512 346333d819dfd8fce980ee5ef97bc721572bb73239d829422231a702ab2f7c8849c95bed90d1002278684b959190b1eeee2a24e3dc81c71266b845a203161c2f
SSDEEP 3072:UgVNODd7FqOKYG7lrX5QphRTw7t++YcaV02KmrZtOLMQH:bAHOHH
TLSH
T169142496C93D84FB30235AD3C7AF7D6455622A0B53EE891832CF86DE6441903C56E8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 d2c79bdb6ad149ee817bdb36d46cb17d8fee26346cee176a1feb3b434a814a51
MD5 99ba8ec88b09074a94818a983c221fae
SHA1 fa73525c19a6b6983478096a4ea81748b27226d7
SHA512 29c9b647dfab241c804810abeb7158a2089510ff5a3f5a5dadd2da978350cffb5673effd8e81357150f83aef47aa780f4966c9d38efd12678eb611cde39c5af0
SSDEEP 3072:UgVNODd7FqOKYG7lrX5QphRTw7t++YcaV02KmrZtOLMQP:bAHOHP
TLSH
T18AF33456C93E84FB64234AD3C7BA7D6466632A0B53DE491832CF86DE6441803C56F8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 84c198f035b90e09f772ea42101a1d02f2801aad0faf8ed7d1e9b9ce0ff537db
MD5 573d5d521b23e9d52a38934c91a91946
SHA1 e34a13ef0b53d22e9bdf8db52f5ed7a382cb5b43
SHA512 ce92042690dd5f4c9bbecc5a257d1e5c4307d748c3aed0fc4e2e140268f73eec6d43efe640eb451ff7f125f29df44209c173454801e48ed44fb0437587ca796d
SSDEEP 24576:Uu8m+1zadoO/vvTLb23+SmKDmeEjfVXSLB2tlYG1vkaG+wOq4flu/BMBy:h
TLSH
T18147A52436F92100E7F79F3CA8F06A63893D7D579C15DE8D45411B8E0922BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a9e8b31c-32df-4de0-9ce1-91132a370b54}_OnDiskSnapshotProp

Path \??\Volume{568a4ae8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a9e8b31c-32df-4de0-9ce1-91132a370b54}_OnDiskSnapshotProp
Size 6KB
SHA256 2443f0b551c0febce4d5d0e84c0e2c05fa86017349563c5c08cf224da44e4367
MD5 eb053cab640a6f07737dee48c7edb266
SHA1 fcd1b9769997557b3ca92798da548548eb0eaa7c
SHA512 f69d226cd350e74f3157b27adc01b27457ace37cc1322be18be856b975871d852bdee206bdefa0cab1d48df2cdea65333ffc00f02d3197e527cf3daa640da2de
SSDEEP 96:FBezFlvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:f2b++ZVm
TLSH
T18BD189085AF54311E2B3AB7129F18557A877B911EF33CB8E0298238E6630910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-209-0x0000024FCBDF0000-0x0000024FCBDFC000-memory.dmp

Download

memory/212-1087-0x0000024FCBDF0000-0x0000024FCBDFC000-memory.dmp

Download

memory/444-168-0x0000020101E90000-0x0000020101EC0000-memory.dmp

Download

memory/444-1040-0x0000020101E90000-0x0000020101EC0000-memory.dmp

Download

memory/1368-1050-0x000001F33EEB0000-0x000001F33EEE0000-memory.dmp

Download

memory/1368-164-0x000001F33EEB0000-0x000001F33EEE0000-memory.dmp

Download

memory/1700-1047-0x000001E4A3070000-0x000001E4A30A0000-memory.dmp

Download

memory/1700-165-0x000001E4A3070000-0x000001E4A30A0000-memory.dmp

Download

memory/2928-1037-0x000002111BC60000-0x000002111BC90000-memory.dmp

Download

memory/3084-1036-0x00000193B18F0000-0x00000193B1920000-memory.dmp

Download

memory/3468-1041-0x000001A52D170000-0x000001A52D1A0000-memory.dmp

Download

memory/3468-1042-0x000001A52D260000-0x000001A52D26C000-memory.dmp

Download

memory/3468-166-0x000001A52D170000-0x000001A52D1A0000-memory.dmp

Download

memory/3468-167-0x000001A52D260000-0x000001A52D26C000-memory.dmp

Download

memory/3976-1088-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1089-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1090-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1094-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1100-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1099-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1098-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1097-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1096-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1095-0x000001EAA7170000-0x000001EAA7171000-memory.dmp

Download

memory/3976-1101-0x000001EA9FB00000-0x000001EA9FB30000-memory.dmp

Download